AISEC > Security News > Phishing > 0ktapus Phishing Attack: 130 Companies Hit | MFA Spoofing
August 29, 2022 #phishing Source: Threatpost 3 min read · 675 words

Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms

Щупальця групи загроз '0ktapus' вражають 130 компаній

0ktapus' Massive Phishing Campaign Hits 130 Companies—And MFA Wasn't Enough

One hundred thirty companies. That's the number Threatpost reported were victimized by a threat group calling itself 0ktapus in what amounts to a textbook case of why we can't trust authentication shortcuts anymore.

This isn't some theoretical vulnerability discovered in a lab. This is an active, documented company cyber attack campaign with real victims and specific, documented tactics. And it's the kind of thing that should make every security team sit up and take notice.

Breaking It Down

According to Threatpost, 0ktapus ran a phishing campaign that specifically targeted multi-factor authentication systems. The scope was sprawling—over 130 organizations across industries got caught in their net. But here's what makes this particularly nasty: these attackers weren't brute-forcing anything or finding zero-days. They were using social engineering to trick people into giving up their credentials.

The real question is how so many security-conscious organizations fell for it.

And then it got worse. Once attackers had those credentials, they could bypass MFA systems that were supposed to protect against exactly this scenario. Company cyber attack news outlets have been tracking similar incidents, but the scale here is significant. We're not talking about a handful of targets or a single vertical—this was widespread.

So why does this matter? Because most organizations rely on MFA as their primary defense against credential theft. If attackers can social engineer their way past it, that defense crumbles pretty fast.

The Technical Side

Let's talk about how this actually worked. 0ktapus sent phishing emails designed to look legitimate. The emails directed people to fake login pages—convincing replicas of real authentication systems. When victims entered their credentials, the attackers captured them.

That's step one.

Step two is where it gets interesting. The attackers then used those stolen credentials to attempt legitimate login. The actual authentication system would prompt for MFA. But here's the trick: the attackers would intercept that MFA prompt and relay it back to the victim through the fake login page, asking them to complete the second factor. The victim, believing they're still on the real site, obliges and provides the code.

Now the attacker has everything. Both factors. Real access. No alerts.

It's a relay attack, sometimes called MFA interception, and it's disturbingly effective because it exploits the one thing no amount of technical hardening can fully protect against: human behavior.

Who's Affected

According to Threatpost's reporting, the 130-plus victim companies spanned multiple sectors. Law firm cyber attacks have become increasingly common, and law firms were among the targets here—which isn't surprising given that legal organizations handle sensitive data and often have decent budgets for security (making them attractive targets).

Law firm cyber attack statistics have been trending upward, and this campaign adds another data point to that grim trajectory. When you look at law firms cyber attacks in 2024 and beyond, incidents like this become part of the pattern.

But it wasn't just legal firms. Tech companies, financial institutions, healthcare organizations—0ktapus cast a wide net. The diversity of targets suggests they weren't picky, which also suggests this was primarily a credential-harvesting operation designed to maximize access across as many organizations as possible.

What To Do Now

First, assume your team members have already clicked on something suspicious. That's not cynicism—that's experience. Deploy phishing simulation campaigns immediately if you haven't already, and actually track the results rather than letting them sit in a folder.

Second, consider your MFA implementation. Passwordless authentication systems are increasingly viable. Hardware security keys eliminate relay attacks entirely because they cryptographically verify the legitimate domain you're logging into. If that's not feasible yet, push for it. Make it a roadmap item.

Third, monitor for unusual login patterns—particularly logins from unexpected locations or devices, followed by immediate lateral movement or credential changes. 0ktapus-style attacks leave traces if you're looking for them.

And finally, talk to your employees about what legitimate authentication flows look like. Most phishing attacks work because people genuinely don't know what to expect. Education isn't a silver bullet, but it's significantly cheaper than recovering from a breach.

This campaign was real. The victims were real. And the vulnerabilities it exploited are still present in thousands of organizations right now.

Read original article →

// FAQ

How did 0ktapus bypass multi-factor authentication?

0ktapus used phishing to redirect victims to fake login pages, then relayed the legitimate MFA prompts back to victims in real-time, tricking them into providing the second authentication factor that the attackers then used for real access.

What industries were targeted in the 0ktapus phishing campaign?

The 130+ victim organizations spanned multiple sectors including law firms, technology companies, financial institutions, and healthcare organizations, suggesting the threat group was broadly focused on credential harvesting across diverse industries.

How can companies protect against MFA relay attacks like 0ktapus used?

Hardware security keys that verify the legitimate domain provide the strongest protection. Passwordless authentication, monitoring for unusual login patterns, and regular phishing awareness training for employees also significantly reduce risk from these attacks.

// RELATED

#phishing SLH Offers $500–$1,000 Per Call to Recruit Women for IT Help Desk Vishing Attacks 2026-02-25 #phishing ‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA 2026-02-20

Concerned about your project's security? Run an automated pentest with AISEC — AI-powered scanner with expert verification. Go to dashboard →