{"id":13327,"date":"2022-08-27T14:41:07","date_gmt":"2022-08-27T14:41:07","guid":{"rendered":"https:\/\/scienceandnerds.com\/2022\/08\/27\/a-huge-phishing-campaign-has-targeted-over-130-companies-affecting-twilio-and-signal\/"},"modified":"2022-08-27T14:41:08","modified_gmt":"2022-08-27T14:41:08","slug":"a-huge-phishing-campaign-has-targeted-over-130-companies-affecting-twilio-and-signal","status":"publish","type":"post","link":"https:\/\/scienceandnerds.com\/2022\/08\/27\/a-huge-phishing-campaign-has-targeted-over-130-companies-affecting-twilio-and-signal\/","title":{"rendered":"A huge phishing campaign has targeted over 130 companies, affecting Twilio and Signal"},"content":{"rendered":"

Source: https:\/\/www.theverge.com\/2022\/8\/26\/23323036\/phishing-scam-campaign-twilio-hack-companies<\/a>
\n
<\/br><\/code><\/p>\n

\n

Over 130 organizations, including Twilio<\/a>, DoorDash<\/a>, and Cloudflare, have been potentially compromised by hackers as part of a months-long phishing campaign nicknamed \u201c0ktapus\u201d by security researchers. Login credentials belonging to nearly 10,000 individuals were stolen by attackers who imitated the popular single sign-on service Okta, according to a report from cybersecurity outfit Group-IB<\/a>. <\/p>\n

As Group-IB goes on to detail, the attackers used that access to pivot and attack accounts across other services. On August 15th, the secure messaging service Signal alerted<\/a> users that the attackers’ Twilio breach allowed them to reveal as many as 1,900 Signal accounts<\/a> and confirmed they were able to register new devices to the accounts of a few, which would allow the attackers to send and receive from that account. This week Twilio also updated its breach notification<\/a>, noting that 163 customers had their data accessed. It also noted that 93 users of Authy, its cloud service for multifactor authentication, had their accounts accessed and additional devices registered.<\/p>\n

Targets of the phishing campaign were sent text messages that redirected them to a phishing site. As the report from Group-IB states, \u201cFrom the victim\u2019s point of view, the phishing site looks quite convincing as it is very similar to the authentication page they are used to seeing.\u201d Victims were asked for their username, password, and a two-factor authentication code. This information was then sent to the attackers. <\/p>\n

\n