2022 · Phishing campaign

0ktapus, 2022: one text message, one hundred and thirty companies

Case file · 4 min read · Published 14 September 2026

People affected: ~9,900 accounts and ~5,400 one-time codes captured across 130+ organisations
When it happened: July – August 2022
Made public: August 2022
How they got in: SMS phishing to employees, directing them to convincing fake single sign-on pages that relayed credentials and one-time codes in real time
Attributed to: A group tracked as 0ktapus / Scatter Swine, overlapping with what later became known as Scattered Spider
What it cost: Not disclosed; downstream compromises at Twilio, Signal, DoorDash, Mailchimp and others

What was exposed: Corporate credentials · One-time passcodes · Customer support tooling access · Phone numbers of 1,900 Signal users

In the summer of 2022, employees at more than a hundred technology companies received a text message saying their single sign-on password had expired. The page it led to looked exactly right, asked for a password, then asked for the six-digit code from their authenticator app. Thousands of people typed both in. One company's staff did the same and nothing happened, and that difference is the entire lesson of this case.

What happened

The campaign was industrial rather than clever. The attackers registered domains combining a target company's name with words like -sso, -okta or -help, stood up phishing pages that mirrored each company's real login screen, and sent SMS messages to employees' personal mobile numbers claiming a password reset or schedule change required them to log in.

The important mechanism was what happened next. The phishing page did not simply store the credentials for later. It relayed them to the real login page immediately, in real time, and when the real service asked for a one-time code, the phishing page asked the victim for it and relayed that too. The victim experienced a login that appeared to work. The attacker got a live session.

Group-IB's later analysis found roughly 9,900 sets of credentials and about 5,400 one-time codes captured, across more than 130 organisations. The targeting concentrated on technology, telecoms and cryptocurrency companies — which is to say, on companies whose systems provide access to other companies' customers.

Why a one-time code is not phishing-resistant. A code from an app or a text message is a shared secret that the human copies from one place to another. Anything that can convince the human to copy it into the wrong box defeats it, and the attacker has thirty seconds to use it, which is plenty when the relay is automated. A security key or passkey is different in kind, not degree: the browser performs a cryptographic challenge that is bound to the real domain name. Present it a lookalike domain and it will not produce a signature at all. There is nothing for the user to get wrong.

The company it did not work on

Cloudflare was targeted in the same campaign, with the same message format, within the same minutes. Its employees received 76 messages. Some of them clicked. Some of them entered their credentials on the fake page.

The attack failed at the next step. Cloudflare required hardware security keys for all employees, and the keys would not authenticate to a domain that was not Cloudflare's. The attackers had valid passwords and no way to use them. Cloudflare published a detailed account of the attempt, including the fact that its own people had been fooled by the message — which is the part worth dwelling on. The control that saved them did not depend on anyone spotting anything.

What the access was used for

Compromised employee accounts were not the objective. Customer support and administrative tooling was.

Twilio — Attackers reached internal customer support systems. Twilio reported 209 customer accounts and 93 Authy users affected.
Signal — Twilio provides Signal's phone number verification. About 1,900 users' phone numbers were exposed and a small number of accounts were re-registered to attacker devices. Message history was not exposed; Signal cannot read it.
DoorDash — Disclosed a breach traced to a compromised third-party vendor in the same campaign, exposing customer and delivery worker data.
Mailchimp — A compromise of internal tooling led to access to customer accounts, which in turn led to the compromise of mailing lists belonging to its customers, including cryptocurrency firms.

Each of these is one step further from the original phishing text, and each step multiplies the affected population. A campaign against employees ended up affecting people who had never heard of Twilio.

What it changed

Hardware keys and passkeys moved from best practice to baseline. Cloudflare's published account did more for the adoption of phishing-resistant authentication than any advisory. It was a controlled comparison run by accident: same attacker, same messages, same human error rate, different outcome.

SMS-based second factors began to be retired. Not only because of interception, which is the usually cited risk, but because the real-time relay attack makes any user-transcribed code replayable.

Customer support tooling got treated as production infrastructure. Support consoles that can look up any customer, reset any account or read any number had often been secured as internal tools. After 2022 a great many of them acquired stronger authentication, tighter scoping and actual audit logging.

The campaign's people became the next few years of intrusions. The social engineering tradecraft visible in 0ktapus — targeting recovery flows, impersonating IT, exploiting the phone — recurs directly in the attacks on Las Vegas casinos in 2023 and in a long run of help desk compromises since.

What to take from it

Move your most important accounts to passkeys or a security key. Email first, because email resets everything else. This is the single change that defeats the technique described here.
Treat any login page you arrived at from a message as hostile. Not because you will spot the fake — the people in this case did not — but because navigating there yourself removes the attack entirely.
A code you were asked for is more dangerous than a password you volunteered. Legitimate services do not phone or text asking you to read a code back. That request is, on its own, sufficient evidence of an attack.
Assume your work phone number is known. It leaks from directories, breaches and conference lists, and it is the delivery channel for this entire class of attack.

Questions people ask

If they had one-time codes, is two-factor authentication useless?

No — the type matters enormously. Codes from an app or an SMS can be typed into a fake page and replayed by the attacker within their thirty-second window. A hardware security key or passkey cannot, because it checks the website's real domain before it will sign anything, and a lookalike domain simply gets nothing. Cloudflare's employees clicked the same links as everyone else. Their keys refused to authenticate to a site that was not the real one.

What actually happened to Twilio customers?

Twilio said 209 customer accounts and 93 Authy users were affected. The most-reported downstream effect was at Signal, where the attackers used Twilio's customer tooling to re-register a small number of accounts: about 1,900 users' phone numbers were exposed and up to three accounts were re-registered to attacker-controlled devices. Signal's message contents were not accessible, because they are end-to-end encrypted and Signal itself cannot read them.

Why is it called 0ktapus?

Group-IB, which analysed the campaign, named it after the phishing pages themselves — most impersonated Okta, the single sign-on provider many of the targeted companies used. Okta was not breached in this campaign. It was impersonated, which is a hazard of being the login screen everybody recognises.

How did attackers know which employees to text?

Phone numbers for employees at targeted companies were obtained in advance, reportedly including from data taken in earlier compromises. This is the compounding effect of breaches: the output of one becomes the targeting list for the next, and a leaked corporate directory is worth far more as an input to phishing than it ever was as a standalone file.

Sources

Group-IB — Roasting 0ktapus: the phishing campaign going after Okta identity credentials — the analysis that mapped the campaign's scale
Twilio incident report, August 2022
Cloudflare — The mechanics of a sophisticated phishing scam and how we stopped it
Signal statement on the Twilio incident, August 2022