Swimming past 2FA, part 2: How to investigate Okta compromise

This post documents an investigation of an Okta MITM phishing incident where stolen Okta credentials allowed an attacker to access G Suite via SSO and download sensitive Google Drive files; the report walks through Okta and Google Drive audit logs that show the activity, identifies a malicious IP used by the attacker, describes automated workflows used to quickly enumerate file access and impacted accounts, and recommends immediate remediation (reset credentials, force logout/clear sessions) and adoption of phish-resistant MFA (FIDO/WebAuthn).