Okta Environments Seeing Increased Targeted Threat Activity

**Executive summary:** Arctic Wolf Labs reports an increase in threat activity targeting Okta—attackers use social engineering to reset MFA for Super Administrator accounts, create inbound federated IdP trusts to impersonate users, and in at least one case (MGM Resorts) activity tied to Scattered Spider/ALPHV resulted in compromise; the bulletin describes detections and recommends Okta best practices and security awareness training.