130+ Companies Just Got Phished by '0ktapus'—And It's Worse Than You Think

Over 130 companies. That's the scale of the phishing campaign Threatpost recently reported on, and it's not some theoretical exercise or proof-of-concept attack. This is active, ongoing cybersecurity warfare happening right now.

The threat group behind it? They're calling themselves '0ktapus,' and they've figured out something genuinely clever: spoofing multi-factor authentication systems to harvest credentials at scale. So while you thought MFA was your security blanket, these attackers found a way to make it work against you.

Breaking It Down

Here's what makes this campaign different from the usual phishing noise we deal with. Instead of just creating fake login pages and hoping for the best, 0ktapus went after the authentication layer itself. They're spoofing MFA prompts—the very thing that's supposed to protect users when their password gets compromised.

According to Threatpost's reporting, the attackers are using phishing emails to trick users into entering their credentials, then immediately presenting fake MFA verification screens. By the time the victim realizes something's wrong, the attacker's already got their username, password, and—critically—they've manipulated the user into revealing what they think is a legitimate second factor.

The scope is staggering. One hundred and thirty companies across multiple industries. And Threatpost notes that many of these organizations have sophisticated security teams. They weren't low-hanging fruit; these are companies that should know better.

The Technical Side

So how does this actually work? The attack chain is deceptively simple, which is probably why it's so effective.

It starts with a phishing email—nothing revolutionary there. But instead of linking to a page that mimics a company's login portal, the email often directs victims to a credential harvesting page that impersonates the organization itself or a service provider. Once the user enters their credentials, they get redirected to what appears to be an MFA verification screen.

And here's where it gets mean. That fake MFA prompt doesn't actually validate anything. It just collects whatever the user enters—their authenticator app code, their SMS token, whatever. The attacker now has everything needed for account takeover.

The reason this works? Human psychology. When you see an MFA prompt, your brain switches into a different mode. You're no longer thinking "is this real?"—you're just trying to complete the process. It's the security equivalent of a magic trick: misdirection at the right moment.

Who's Affected

Threatpost didn't disclose all 130 victims, but that's actually the concerning part. We don't know the full damage assessment yet. Some targets have already gone public; others probably haven't noticed the compromise, or they're quietly investigating before disclosure.

The industries hit? Tech companies, financial services, government contractors. Basically, the organizations attackers most want to infiltrate.

What To Do Now

First, stop treating MFA as a magic bullet. It's still essential—don't disable it—but understand that it's one layer, not the whole defense.

Second, check your email logs. Look for suspicious phishing campaigns targeting your organization. If you spot them, investigate whether anyone actually clicked through and entered credentials. This isn't optional—if 0ktapus hit your company, the damage clock is already running.

Third, educate your team on MFA fatigue attacks. Users need to understand that legitimate MFA prompts won't appear after a phishing email. If they got redirected to a login screen from an email, then got an MFA prompt immediately after, that's not how it actually works.

And finally, implement phishing-resistant authentication if you can. FIDO2 security keys, Windows Hello, passkeys—these eliminate the attack vector entirely because there's no credential for an attacker to harvest in the first place.

The 0ktapus campaign isn't going to stop. As long as MFA-spoofing works, they'll keep using it. Your job? Make sure it doesn't work against your organization.