Okta Warns of Credential Stuffing Attacks Targeting Customer Identity Cloud

Okta warned that a cross-origin authentication feature in its Customer Identity Cloud has been targeted by credential stuffing attacks beginning April 15, 2024; customers with the feature enabled were proactively notified. The advisory lists relevant log events to monitor (fcoa, scoa, pwd_leak), recommends rotating credentials, restricting or disabling cross-origin authentication, enabling breached password detection or Credential Guard, enforcing stronger authentication (passkeys/passwordless) and other mitigations to reduce the risk of account takeover.