Phishing Kits Now Sync With Live Phone Scammers to Defeat Multifactor Authentication

Okta researchers warn of commercially available vishing toolkits that synchronize fake login pages with live phone calls to orchestrate authentication flows and bypass non-phishing-resistant MFA (push notifications, OTPs, backup codes). These kits provide attacker control panels for real-time session orchestration, are being sold as-a-service targeting Google, Microsoft, Okta and cryptocurrency platforms, and defenders are advised to adopt phishing-resistant authentication (e.g., FIDO/passkeys), implement network allowlisting and tenant access controls, and consider live caller verification.