Swimming past 2FA, part 1: How to spot an Okta MITM phishing attack

This blog post details an Okta-targeted credential-phishing campaign where attackers sent phishing links (via SendGrid) to fake Okta login pages and a malicious Duo MFA page to bypass MFA using a MITM workflow; it covers how responders detected the compromise by correlating Duo access and authentication device IPs and using geo-distance checks, highlights telltale signs of the fake pages, and provides prevention and detection recommendations for organizations.