Roasting 0ktapus: The phishing campaign going after Okta identity credentials

Group‑IB documents the '0ktapus' SMS phishing campaign that targeted Okta customers by sending links to convincing fake Okta login pages to capture credentials and 2FA codes; the phishing kit (Nuxt.js frontend, Django backend) delivered stolen data to a Telegram channel, enabling immediate account takeover and follow-on supply‑chain compromises (notably impacting Twilio, Mailchimp, and Klaviyo). The analysis enumerates 169 phishing domains, kit artifacts used for tracking, affected industries and geolocations, identification attempts against a suspected operator ('Subject X'), and actionable mitigations including adoption of FIDO2 hardware keys and cautious URL handling.