A new wave of ‘vishing’ attacks is breaking into SSO accounts in real time

Researchers are tracking an active voice-phishing campaign that uses custom domains and real-time phishing kits to impersonate SSO providers (Okta, Google, Microsoft) and socially engineer victims into approving MFA or submitting credentials; the operation has led to data theft and extortion claims (notably impacting SoundCloud and Betterment) and involves at least ~150 malicious domains and tailored caller scripts.