Okta Warns of Phishing Attacks Mimic “Okta Support” to Steal MFA Tokens

Okta has warned of a sophisticated phishing campaign impersonating its support team to steal credentials, MFA tokens, photo IDs and password reset links from customers; attackers use real-time phishing kits, CAPTCHA evasion, precise SSO page cloning, and custom sites tied to victim phone numbers, and initially hosted infrastructure on Hostwinds/Hostinger before moving to a Russia-based provider. Okta clarified official email/SMS channels and urged reporting and stronger MFA and user education to mitigate the campaign.