AISEC > Security News > Phishing > 0ktapus Phishing Campaign Targets 130+ Companies
August 29, 2022 #phishing Source: Threatpost 3 min read · 632 words

Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms

Щупальця групи загроз '0ktapus' атакували 130+ компаній

0ktapus Threat Group's Phishing Blitz Hits 130+ Companies—Here's What Happened

Over 130 companies got caught in the crosshairs of a single threat group. That's not a typo. According to Threatpost, the 0ktapus crew orchestrated a large-scale phishing campaign that specifically targeted multi-factor authentication systems, which is frankly infuriating because MFA is supposed to be our safety net against exactly this kind of thing.

And now it's compromised at scale.

Breaking It Down

Here's what we're dealing with: 0ktapus ran a coordinated phishing operation that fooled employees at multiple organizations into surrendering their credentials—not just their passwords, but the second factor that's supposed to lock attackers out entirely. Threatpost's reporting from August 2022 confirmed victims spanning multiple industries, which means this wasn't targeted at one vertical; it was a broad sweep.

The scope is what gets to me.

When you're dealing with attacks on this scale, you're not looking at a handful of sloppy phishing emails anymore. This is operationalized. This is a threat group that knows what they're doing, has the infrastructure to support it, and clearly has enough confidence in their technique to deploy it across 130 different environments with different security postures.

The group's name itself is clever—a reference to the octopus, an animal known for having many arms reaching into different places simultaneously. That's exactly what this campaign looked like: tentacles extending into organization after organization, all pulling the same way.

The Technical Side

So how'd they actually pull this off? The mechanics here are deceptively simple, which is why they work so well. The attackers built phishing pages that mimicked legitimate MFA prompts—the kind that pop up when you log into your email or corporate applications. Employees would receive a convincing email, click a link, get redirected to the fake authentication page, and enter their credentials plus their MFA code without thinking twice.

That MFA code?

It's time-limited. That's the whole point. But if you're capturing it in real-time—if your fake login page automatically submits it to the real authentication system while the employee's still typing—the attacker gets a valid session. The two-factor protection becomes window dressing.

This is what security folks call a "man-in-the-middle" play, except instead of being in the middle of the network, the attacker's in the middle of the user's decision-making process. And it's particularly nasty because no zero-day vulnerability needs to exist. No patching required. Just good social engineering wrapped in technical execution.

Who's Affected

The victim list spans multiple sectors—we're talking finance, technology, government contractors, and more. Threatpost's reporting didn't name every organization, but the breadth of the campaign became clear quickly. If you work at a mid-to-large enterprise with a decent security profile, there's a non-trivial chance you were targeted, even if you didn't realize it.

The real question is: how many of those 130 organizations actually got breached versus how many caught the attempts?

What To Do Now

First: audit your email filtering and gateway security right now. Phishing campaigns at this scale are detectable if you're looking for the pattern—redirects to lookalike domains, emails requesting MFA codes, that sort of thing.

Second, and this matters: your employees need training that actually sticks. Not the annual checkbox thing—real, practical scenarios that show people what a spoofed MFA prompt actually looks like versus the real thing.

Third, consider implementing conditional access policies. If a login attempt comes from a location or device that doesn't match baseline behavior, step up the verification requirements. Make the attacker's job harder even if they do get a valid code.

Check your logs for suspicious authentication attempts around late August 2022. If you see patterns you can't immediately explain, escalate to your incident response team. Because unlike some phishing campaigns, this one was targeted enough that victims probably had indicators worth finding if you look back.

Read original article →

// FAQ

Was my company targeted by the 0ktapus phishing campaign?

Threatpost confirmed over 130 companies were victimized across multiple industries. If you work at a mid-to-large enterprise, check your email gateway logs and authentication systems for suspicious activity around August 2022, or contact your security team for details about whether your organization was on the target list.

How did 0ktapus bypass multi-factor authentication?

The group created fake MFA prompts that captured credentials and time-limited authentication codes in real-time, then submitted them to legitimate systems before the codes expired—essentially performing a man-in-the-middle attack at the user level rather than the network level.

What should I do if I clicked a phishing link from 0ktapus?

Reset your password immediately and notify your IT security team. If you entered an MFA code, assume your account was compromised and check for unauthorized activity. Enable additional monitoring on accounts with access to sensitive systems and review recent login history for anomalies.

// RELATED

#phishing SLH Offers $500–$1,000 Per Call to Recruit Women for IT Help Desk Vishing Attacks 2026-02-25 #phishing ‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA 2026-02-20

Concerned about your project's security? Run an automated pentest with AISEC — AI-powered scanner with expert verification. Go to dashboard →