Okta Under Siege Attackers Call Help Desks To Bypass MFA and Steal SaaS Data

Attackers are increasingly using 'Okta vishing'—voice phishing and social engineering against users and help desks—to manipulate or reset MFA and gain SSO access to cloud SaaS environments. This enables immediate access to Microsoft 365, SharePoint, OneDrive, Google Workspace, Salesforce, Slack and other tenant resources, often resulting in direct data theft, mailbox forwarding/persistence and OAuth abuses. The report outlines the attack flow (reconnaissance, social-engineering call, MFA manipulation, SSO pivot, data theft), impacted assets, and mitigations including stronger verification, phishing-resistant MFA (FIDO2/passkeys), conditional access, help-desk training, and improved detection and playbooks.