Cybercriminals Targeting Two-Factor Authentication

This report analyzes the rise of automated OTP-interception services—Telegram- and Discord-based bots that perform caller-ID spoofing and IVR-based voice calls to capture one-time passwords and other PII—profiling multiple services (SMSranger, OTP BOSS, PizzaOTP, PepeOTP and others), their modes of operation, geographic targeting, monetization, and offering pragmatic mitigation advice for organizations and consumers.