Okta Warns Once Again of Credential-Stuffing Attacks

Okta warned of credential-stuffing attacks observed beginning April 15 that targeted the cross-origin authentication (CORS) feature of its Customer Identity Cloud; customers should monitor SCOA/FCOA/pwd_leak events in tenant logs and apply mitigations such as restricting permitted origins, enabling breached-password detection, enforcing MFA or passwordless/passkey authentication, and disabling cross-origin endpoints if unused.