Okta Under Attack as Hackers Skip Phishing for Identity Systems

Attackers are increasingly using voice‑based social engineering ('Okta vishing') to trick employees and help desks into resetting MFA, enrolling attacker devices, or approving push notifications, which lets them gain control of identity providers (e.g., Okta) and immediately pivot via SSO into cloud services (Microsoft 365, SharePoint, OneDrive, Google Workspace, Salesforce, Slack) to exfiltrate data. The report outlines the reconnaissance and vishing call flow, detection clues for identity and SaaS telemetry, and defensive recommendations such as strict verification for MFA resets, banning legacy auth, restricting OAuth consent, mandating phishing‑resistant MFA, and having SOC playbooks to revoke sessions and remove rogue factors.