Okta Warns of Unprecedented Surge in Proxy-Driven Credential Stuffing Attacks

Okta reported a notable spike (April 19–26, 2024) in credential stuffing attacks targeting online services, orchestrated using TOR exit nodes and residential proxy networks created by proxyware/botnet-infected devices — including via malicious Android VPN apps embedding proxy SDKs — and fueled by combo lists and scripting tools; millions of unauthorized requests were observed, and Okta recommends stronger authentication (2FA/passkeys), password hygiene, and blocking high‑risk IPs and regions.