Okta SSO accounts targeted in vishing-based data theft attacks

Okta warns of commercially sold vishing phishing kits used in active campaigns to perform live adversary-in-the-middle attacks against identity providers (including Okta), enabling attackers to interact via phone calls, manipulate phishing pages in real time, capture SSO credentials and MFA codes, bypass push-based MFA, access victims' Okta dashboards to exfiltrate data (notably from services like Salesforce), and subsequently extort affected organizations; Okta recommends using phishing-resistant MFA such as FIDO2/passkeys.