Okta warns of credential stuffing attacks targeting its CORS feature

Okta warns that since April 15, 2024 threat actors have been conducting large-scale credential-stuffing attacks targeting the Customer Identity Cloud cross-origin authentication (CORS) feature; Okta notified affected customers and provided detections (watch for 'fcoa', 'scoa', and 'pwd_leak' events) and mitigations including immediate credential rotation, disabling unused cross-origin authentication, enforcing MFA or passwordless phishing-resistant auth, and enabling breached-password detection.