Threat Intelligence | Blog | Okta

How to stop attackers from self-serving their way into accounts

Brett Winterford — Thu, 09 Jul 2026 16:00:00 +0000

Executive Summary

Over the last 12 months, Okta Threat Intelligence has observed a growing number of attacks in which users are tricked into approving attacker-initiated MFA enrollments and password resets.

We have observed numerous related clusters of activity in which threat actors have tested, iterated on, and scaled these social engineering attacks.

One in five of the proactive notifications Okta sent to customers over the last month related to phishing domains that included the string "passkey". The most recent campaign observed (O-UNC-066) used a passkey enrollment pretext to gain persistent access to Entra accounts.

Strengthening MFA enrollment and account recovery now needs to be a priority for every identity team, irrespective of platform or use case.

Threat Analysis

Until 2025, the largest share of social engineering activity we observed was impersonating IT support and other helpdesk staff to trick users into entering their password and OTP on attacker-controlled phishing sites.

This category of credential phishing is rendered ineffective when organizations require the use of phishing resistant authenticators in policy. Under phishing resistant policy conditions, even when a user is tricked into visiting an attacker-controlled site, the user is unable to share their access credentials.

Several clusters of threat activity have since adapted to their target's adoption of phishing resistance by using methods of attack that bypass the need to steal and replay a user's credentials.

The list of threat activity clusters below, presented chronologically from oldest to most recent, highlights some of these tactics.

Threat Actor	Targeted Process	TTPs
O-UNC-025	Enrollment (passkey enrollment)	Attacker impersonates the security team of the targeted organization to drive users to a phishing page that encourages them to set up a passkey.
O-UNC-028	Recovery (password reset)	Attacker impersonates the employer's IT helpdesk, lures targets to a phishing page and/or to authorize an attacker-controlled application.
O-UNC-045	Enrollment (passkey or authenticator app enrollment)	Attacker impersonates the employer's IT helpdesk in voice calls to drive targets to credential phishing sites.
O-UNC-053	Recovery (password reset)	Attacker impersonates the employer's IT helpdesk, and uses urgency around the need for a password reset as a pretext.
O-UNC-066	Enrollment (passkey enrollment)	Attacker impersonates the employer's IT team in voice calls to drive targets to credential phishing sites, uses stolen credentials to enroll an attacker-controlled passkey in the user's account.
O-UNC-067	Recovery (password reset)	Attacker simultaneously triggers the "forgot password" flow while on the call, socially engineers the user into approving the reset

Notably, we have yet to observe the threat actor Okta tracks as O-UNC-067 using credential phishing kits in order to take over accounts.

This intrusion actor, active since at least June 2026, selectively targets organizations configured to allow self-service password reset (SSPR).

The threat actor first performs reconnaissance on targets to assess whether a link to trigger a password reset is accessible, and to determine what MFA challenges apply to verify the user's identity when this password reset is triggered. If a SSPR option is enabled and the user is able to verify their identity during that flow using MFA factors that are not phishing resistant, the attacker calls their target while simultaneously triggering the password reset flow.

Breaking down the account recovery process

Minimum viable defense

Irrespective of whether a social engineering campaign targets authenticator enrollment (e.g., O-UNC-066) or targets authenticator recovery (e.g., O-UNC-067), the success or failure of the attack hinges on the target's org-level account management policies.

In the weakest account management configuration:

A password reset link is available on a public sign-in page
MFA enrollment policies allow verification of the user's identity via any MFA factor
MFA enrollment policies allow verification from any IP address

This configuration may be appropriate for some customer identity use cases, but less so for workforce customers. An attacker that has engaged a targeted user on the phone can trigger the password reset from their device while convincing the user to share an OTP or accept a push request to approve the reset event.

Okta administrators can very easily add friction directly in the MFA enrollment policy by:

Requiring additional verification (beyond a single factor challenge) to initiate the reset, and
Restricting the ability to use self-service features to trusted IP ranges.

This adds friction that prevents opportunistic attacks, but would not withstand a determined adversary. A social engineering actor that triggers the self-service event is in a position to select from a list of available verification challenges during recovery, and will always choose the weakest, most "phishable" method of authentication.

That's why every Okta customer should be taking a close look at Okta account management policies.

Applying phishing resistance to authenticator enrollment

Okta account management policies (AMPs) were originally introduced to support the authenticator lifecycle requirements of organizations that use passwordless authentication. Increasingly, these policies should also be viewed as a configuration tool that protects all authenticator enrollment and recovery flows from social engineering attacks.

AMPs offer administrators the same rich set of policy constraints to account recovery that were previously only available to authentication. AMPs can be used to require verification using phishing resistant factors, managed devices, trusted networks or a range of other criteria, effectively applying "zero trust" to the account recovery process.

Okta Threat Intelligence recommends the use of Okta account management policies to apply phishing resistance to authenticator enrollment and recovery. AMPs can require a user to verify their identity using a phishing resistant authenticator before they add or modify an authenticator.

In the strongest account management configuration available, user accounts are bootstrapped using pre-registered physical security keys, and the account management policy always requires that the user verifies their identity using a phishing resistant factor before they can add or modify an authenticator. This neutralizes attacks on both authenticator enrollment and recovery. Where (rare) edge cases emerge, Okta integrates with identity verification services that require a user to provide a government-issued ID and satisfy a liveness check to initiate recovery.

The next strongest approach is to use Okta AMPs, groups and event hooks to gradually raise the enrollment assurance bar for workforce users that are not already enrolled in a sufficient number of phishing resistant authenticators.

Under such a scenario, the top (first evaluated) AMP rule might allow a user to add or modify a factor if the request comes from a managed device and the user satisfies a phishing-resistant MFA challenge. The aim should be for all users to progressively be added to the group in scope for this rule and subsequently be constrained to only using phishing resistant factors during factor lifecycle events. Users that trigger policy rules beneath it should be prioritized for migration.

The next rule might constrain a user in whatever way possible until the user has enrolled in a sufficient number of phishing resistant authenticators. Users may be required to satisfy an Identity Verification (IdV) challenge, for example, or be temporarily allowed to verify their identity using weaker authenticators for their first few days of onboarding if they enroll from a trusted network. Event hooks or Okta Workflows can also be used to automatically advance users into groups with stronger assurance requirements as they meet the necessary criteria.

Always remember to add a catch-all deny as the final (bottom) rule in any policy, to prevent any unintended access scenarios.

Applying phishing resistance to authenticator recovery

The key to phishing resistant recovery is to enroll users in a sufficient number of phishing resistant authenticators to account for any loss or disruption of a single device.

One of the greatest strengths of the Okta Verify client is that there is zero marginal cost for a user to enroll multiple devices in their Okta Verify account. A user can enroll from their managed laptop and smartphone, for example.

When every workforce user is enrolled in multiple phishing resistant factors (Okta Verify installs) across more than one device, the number of account recovery events that require the helpdesk falls considerably. If a user loses a device or if the device is unresponsive, they will still have strong, phishing-resistant authenticators enrolled on a second device (e.g., smartphone vs laptop) or via an external security key which they can use to enroll a new or replacement device.

Subsequently there is no need to include a "forgot password" link on the sign-in page, and there is no need to offer weaker account management policies.

Indicators

Indicators associated with the clusters of activity discussed above are all available to the security contacts of Okta customers at:
https://security.okta.com/?product=oktathreatintelligence

Recommendations

ATT&CK technique	Tactic	Control
T1590 / T1591	Reconnaissance	Restrict recovery operations for workforce users to behind authenticated user settings. If a workforce organization is configured to support self-service recovery (the "forgot password" flow), consider restricting the IP range from which the sign-in page can be accessed to a known or trusted network using Okta network zones.
T1583 / T1584	Resource Development	Deny requests from known anonymizing services and proxies using enhanced dynamic zones.
T1566 / T1598	Phishing / Vishing	Enroll users in strong authenticators such as Okta FastPass, passkeys or smart cards and enforce phishing resistance in policy. Establish, communicate and evangelise methods of verifying the identity of helpdesk personnel when they contact users. Apply Okta account management policies that constrain the ability to modify authenticators. Apply temporary access codes as a preferred method for recovering access after identity verification.
T1078	Valid Accounts (Initial Access)	Okta authentication policies can be used to restrict access to user accounts based on a range of customer-configurable prerequisites. We recommend administrators restrict access to sensitive applications to devices that are managed by Endpoint Management tools and protected by endpoint security tools.
T1621	MFA Request Generation	Enroll users in strong authenticators such as Okta FastPass, FIDO2 WebAuthn, and smart cards and enforce phishing resistance in policy.
T1098.005	Account Manipulation - Device Registration	Apply Okta account management policies that constrain the ability to modify authenticators.

Nick Connolly contributed to this article.

Vishing actors target Entra passkey enrollment

Sun, 05 Jul 2026 16:00:00 +0000

Executive Summary

Since April 2026, a threat actor tracked as O-UNC-066 (also known as "Pink" by Palo Alto Networks Unit 42) has deployed a panel-controlled phishing kit targeting the passkey enrollment process for Microsoft 365 customers.

Okta has observed the targeting of enterprise organizations across the food and beverage, technology, healthcare, automotive, construction, and aviation industries by this cluster of activity. The primary motivation of the threat actors is data extortion.

The threat actor registers domains that incorporate the word passkey as part of a voice-enabled phishing ("vishing") scheme. The threat actor then calls targeted users on the phone in an attempt to persuade them that they need to register a new passkey.

Users are directed to a phishing kit that closely mimics the Microsoft passkey enrollment process. It appears engineered to convince a targeted user they are in the process of enrolling a passkey with Microsoft, while the threat actor simultaneously registers their own passkey in the targeted user's Microsoft account.

This pretext is well-timed - as of May 2026, Microsoft administrators have been able to create passkey registration campaigns that remind or "nudge" users to enrol in passkeys at sign-in, and in some circumstances these nudges are on by default.

Threat actors have used this well-intentioned security upgrade as a pretext for abusing the enrolment process to further their objectives.

Our analysis of the phishing kit revealed that it does not attempt to handle federation to third-party Identity Providers such as Okta. Subsequently, we have not observed the compromise of Microsoft accounts directly.

Threat Analysis

In the threat activity we observed, the threat actor creates per-target subdomains that mimic Microsoft Entra ID login pages. The pages are customized using each victim organization's legitimate branding. Generic Microsoft styling is loaded from Microsoft's Content Delivery Network, while the branding elements relevant to each victim organization (logo and background) is pre-staged per subdomain as part of the configuration for any given target and served from the backend of the phishing kit.

The kit is not a transparent Adversary-in-the-Middle (AitM) proxy, one of the most frequently seen types of phishing kits designed to collect credentials, MFA tokens and session tokens. It is an operator-controlled PHP panel in which a threat actor steers victims through various stages of authentication in close to real-time using a 1-second heartbeat polling mechanism. The operator can use the kit to adapt the user experience to each victim's MFA requirements (TOTP, push notification with number matching, SMS OTP) during the session. This operational design is consistent with the vishing tradecraft documented in Okta's November 2025 public blog post "Phishing kits adapt to the script of callers." The caller can control and adjust in real time what phishing pages and notifications a targeted user sees.

It is likely that the threat actor uses the kit to takeover the user account and trick the user into approving an attacker-initiated registration of a passkey.

Okta Threat Intelligence used code derived from the phishing kit to recreate the following flow, which closely resembles the passkey registration process for Microsoft Entra.

The first page of the phishing kit (/gate) reveals a page loading icon while the phishing kit performs anti-analysis checks. The second page (/identify) requests a username. The phishing kit did not redirect to a federated Identity Provider at the time of our analysis.

The next page (/password) challenges the user for a password. The captured credentials are sent in a POST request with a timestamp and Id to an operator panel at /backend.php.

Our assumption is that a phishing kit operator (which may be a different individual to the caller on the phone) captures the credentials of the targeted user within a few seconds and enters them at the legitimate Microsoft sign-in page for the targeted tenant.

The targeted user then sees a (/processing) page that presents another loading screen while the phishing kit awaits the operator's next instruction. Our assumption is that this small delay is required for a threat actor to authenticate to the user's legitimate Microsoft account using the stolen credentials, to observe what MFA challenges are presented, and select the next page of the phishing kit to present to the user.

next page of the phishing kit to present to the user.

If the operator chooses or is forced to complete an SMS OTP challenge, the user is directed to a page called /submit-otp. The captured OTP is sent in a POST request to the operator panel at /backend.php.
If the operator chooses or is forced to complete a TOTP challenge, the user is directed to a page called /submit-authenticator. The captured OTP is sent in a POST request to the operator panel at /backend.php.
If the operator chooses or is forced to complete a Push MFA challenge, the user is directed to a page called /approve-authenticator (see image below) and asked to enter the number supplied by the operator into their authenticator app.

At this stage of an attack, the user has been tricked over the phone into approving the attacker's access to their Microsoft 365 account.

In keeping with the passkey pretext, threat actors can then direct users to the /passkey/register page, which asks the user to create a passkey.

The phishing kit appears to prey on lack of user familiarity with passkey authentication. In a real passkey registration ceremony, the user might expect a system dialog to register a passkey on their device. The passkey pages in this phishing kit appear to mimic this process without registering a passkey.

At the /passkey page, the targeted user is presented with a Microsoft-branded page that encourages the user to "save your recovery key" from an attacker-controlled list of BIP-39 phrases. This closely resembles the methods used in some cryptocurrency applications to generate memorable seed phrases.

A subsequent /passkey/check page asks the user to verify the final word used in the seed phrase.

We are not aware of any direct applicability of BIP-39 seed phrases to Microsoft Entra or its passkey registration process. An attacker that has already gained unauthorized access to a user account can create their own recovery codes using a process that does not require any input from the real account holder.

It is likely that these passkey-themed pages are available to the phishing kit operator as a sleight of hand. It is a distraction to keep a user occupied on a task while the threat actor enrolls their own passkey in the legitimate Microsoft user account.

The /done page confirms that a passkey registration was successful. An unsuspecting user that does not fully understand how a passkey is enrolled may genuinely believe that they registered one with Microsoft simply by completing these otherwise meaningless tasks.

The operator can choose when to push the /done page to the user. At minimum it helps the phishing operation maintain the original pretext. Any time a user enrolls a passkey with Microsoft, the owner of the compromised account receives a legitimate Microsoft email to notify them that a new passkey had been registered in their account. During an attack, the passkey was actually enrolled by the threat actor directly with Microsoft, and the threat actor is in a position to name the passkey with something the targeted user would view as benign (perhaps even borrowing from the seed phrase selected by the targeted user). The passkey enrollment setup the targeted user experienced on the phishing site, by contrast, is likely to only exist to trick the user into thinking the attacker's enrollment was their own.

Infrastructure

Threat actors were observed creating subdomains for any given targeted entity under the following domains:

assignpasskey[.]com (2026-06-14, Internet Domain Service BS Corp., DDoS-Guard)
deploypasskey[.]com (2026-04-21, Tucows, DDoS-Guard)
passkeydeploy[.]com (2026-04-23, Internet Domain Service BS Corp, DDoS-Guard)
passkeyadd[.]com (2026-05-08, Tucows, DDoS-Guard)
setpasskey[.]com (2026-05-23, IQWeb FZ-LLC)

So a campaign targeting "exampleentity" might be something like:

exampleentity[.]setpasskey[.]com

The phishing infrastructure observed by Okta Threat Intelligence was hosted on DDoS-Guard (AS57724, Russia) and IQWeb FZ-LLC (AS59692, US).

Impact

The data extortion actors associated with the Pink phishing kit published a leak site on May 31, 2026. This site is used to extort and apply pressure to compromised entities in the public domain.

Recommendations

While this cluster of threat activity has not been observed impersonating Okta, similar campaigns have combined voice-based social engineering and operator-controlled phishing kits:

Public Blog Post (publicly available)

Phishing kits adapt to the script of callers

Flash Advisory (Okta customers only)

IT Support Impersonated in Requests for Password Resets

Threat Advisory (Okta customers only)

Vishing Operators Synchronize Phishing Sites to their Script for Hybrid Social Engineering Attacks

The recommendations below are specific to the defence of Okta customers.

ATT&CK

Tactic

Control Recomendation

T1566

Phishing

Enroll users in strong authenticators such as Okta FastPass, passkeys or smart cards and enforce phishing resistance in policy.

Establish, communicate and evangelise methods of verifying the identity of helpdesk personnel when they contact users.

T1078

Phishing

Deny requests from locations where your organization does not offer services. Okta network zones allow administrators to set policies that deny access to Okta-protected applications by geolocation (country), ASN, IP, or other criteria.

T1078

Valid Accounts
(Initial Access)

Okta authentication policies can be used to restrict access to user accounts based on a range of customer-configurable prerequisites. We recommend administrators restrict access to sensitive applications to devices that are managed by Endpoint Management tools and protected by endpoint security tools.

T1078

Valid Accounts
(Initial Access)

Notify users of every authenticator (factor) lifecycle event using end user notifications.

T1098

Account Manipulation (Device Registration)

Apply Okta Account Management Policies that constrain the ability to add or modify authenticators based on network context, device management status and enrolled authenticators.

Specific guidance is provided in a supplementary note attached to the customer-only version of this threat advisory at:
https://security.okta.com/product/oktathreatintelligence/vishing-actors-target-microsoft-entra-passkey-enrollment

Disrupting ShieldGuard: a security extension primed to drain crypto wallets

, Yang Wang, Simon Conant, Adam Smallhorn — Mon, 16 Mar 2026 16:00:00 +0000

Executive summary

Okta Threat Intelligence has discovered and helped industry partners to take down the infrastructure of a cryptocurrency scam called "ShieldGuard".

ShieldGuard claims to be a blockchain project that offers - through its promotion of a browser extension - a capability that blocks known threats to cryptocurrency wallets, such as phishing or malicious smart contracts.

The project was promoted using a multi-level marketing campaign in which users would be rewarded for early use of the extension (via a cryptocurrency "airdrop") and for promoting the capability to other users.

Our analysis of the browser extension, presented in detail below, revealed its true intent: ShieldGuard appears designed to harvest wallet addresses and other sensitive data for major cryptocurrency platforms including Binance, Coinbase, MetaMask, OpenSea, Phantom and Uniswap, as well as for users of Google services.

The extension also extracts the full HTML of pages after a user signs into Binance, Coinbase, OpenSea or Uniswap via their browser.

Threat analysis

ShieldGuard was promoted via a public website as a legitimate security application for users of Web3 services.

The creators of ShieldGuard also registered:

A listing in the Google Chrome Store
A social media profile at x[.]com
A Telegram channel

The web site and associated social media profiles for ShieldGuard claimed the extension would detect suspicious transactions prior to a user signing a request.

The creators of the browser extension attempted to drive downloads by launching an "airdrop".

An airdrop is a marketing campaign in which a blockchain-enabled service is "bootstrapped" by early adopters in the community. Early participants are issued coins or tokens that can be exchanged for some form of value if they sign-up prior to a specified date.

Interested users were encouraged to download the browser extension and sign-up for a user account at a claim portal in order to be eligible for the distribution of these tokens.

The ShieldGuard website reassured potential users that the software would not need direct access to their crypto wallets: the extension would poll a central server for updates on known threats and identify them in the user's browser.

Our analysis of the browser extension found that it includes a range of very different capabilities:

The browser extension harvests cryptocurrency wallet addresses from any website a user visits, using the EIP-6963 wallet discovery protocol
The browser extension exfiltrates full page content from cryptocurrency exchange and DeFi sites (which includes account balances, portfolio data, and transaction history)
The browser exfiltration is capable of executing arbitrary code on a device running the extension, as demonstrated through an ability to block access to legitimate websites on command and replace them with fake security warnings.
The browser extension tracks users via persistent UUIDs across all browsing sessions

Malware analysis

Analysis environment

To safely analyze the threat, we installed ShieldGuard browser extension and executed it within an isolated, containerized browser. Initial static analysis revealed that the extension's code was heavily obfuscated, a technique frequently employed by malicious actors to evade detection during review processes and to complicate reverse-engineering efforts.

Architecture and evasion techniques

ShieldGuard was revealed to be a sophisticated piece of malware designed to bypass the security restrictions of Chrome's Manifest V3. To achieve this, it bundles a complete custom JavaScript interpreter (vendor.js).

Bypassing Remote Code Execution Bans: Instead of using prohibited functions like eval(), the extension's background script fetches encoded script strings from a Command and Control (C2) server. It then uses its custom JS interpreter to parse and execute these scripts within the context of the victim's web pages. This allows the attackers to execute arbitrary remote code on demand without triggering Chrome's security policies.

Deceptive Permissions: Upon installation, the extension requests the permission to "Read and change all your data on all websites," granting it full access to the victim's browsing activity.

Malicious payloads and data exfiltration

Dynamic analysis confirmed the following attack flow:

A user with the browser extension installed navigates to a web site
The extension contacts the Command and Control server at shieldguards[.]net/scripts
The server returns the EIP-6963 wallet discovery script
The script discovers all installed wallets
The script extracts the wallet addresses from discovered wallets
All Ethereum addresses are extracted from discovered wallets
If the user has navigated to Binance, Coinbase, OpenSea or Uniswap, the extension waits for a set period of time before capturing the full HTML of the page
The HTML snapshot is exfiltrated

Our analysis found that the C2 server at shieldguards[.]net actively delivers two primary payloads:

Payload 1: Wallet address harvester (all websites):
A script is injected into every website the victim visits. It uses the EIP-6963 wallet discovery protocol to find all installed wallet extensions (e.g., MetaMask, Phantom, Coinbase Wallet), retrieve all associated Ethereum wallet addresses, and exfiltrate this list to the C2 endpoint at https://shieldguards[.]net/notifications.

This provides the attackers with a comprehensive inventory of a victim's wallets and their browsing habits.

Payload 2: Page content snapshot (targeted crypto sites):
For high-value targets, a second payload is delivered. After a five-second delay to allow the page to fully render, this script captures the entire page's HTML (document.documentElement.outerHTML) and sends it to https://shieldguards[.]net/snapshots. This allows the attackers to steal sensitive data directly from the DOM, including account balances, portfolio holdings, and transaction history.

Command & Control (C2) infrastructure

The browser extension communicates with a C2 server hosted at shieldguards[.]net, which is proxied through Cloudflare.

The key C2 endpoints identified were:


Endpoint	HTTP request method	Purpose
/scripts	POST	Delivers malicious JavaScript payloads.
/snapshots	POST	Receives exfiltrated page HTML.
/notifications	POST	Receives stolen data like wallet addresses.
/check/{domain}	GET	Determines if a domain should be blocked or appear "safe".
/uninstall	GET	Tracks when users uninstall the extension via a UUID.

Attribution and linked campaigns

There is potential that the threat actors are Russian-speaking, based on a Russian error string ("??????: ?? ??????? ?????????? ?????") and Cyrillic character support found within the custom JavaScript interpreter.

The investigation also uncovered strong links to another malicious campaign known as "Radex." We observed links between an administrative account used to set up an Auth0 tenant (radex4me@proton.me) and a Chrome extension ID associated with Radex (fkogigpebmhlbldifmjngmlooifljnif). It is very likely that both campaigns are operatd by the same threat actor.

Disruption

Okta Threat Intelligence has worked with industry partners to:

Disable all sign-in functionality
Remove the shieldguards[.]net domain from CDN services, revealing the website's origin server at Partner Hosting LTD, a bulletproof hosting provider
Remove the shieldguards browser extension from the Google Chrome Store
Remove the shieldguards[.]net domain from its domain registrar - which had the effect of disconnecting existing installs of ther browser extension from the C2 infrastructure.

Advice for end users

Beware the "too good to be true" trap

While legitimate sign-up promotions exist, scammers frequently use the promise of free crypto or high returns to create a false sense of urgency. If an offer looks too good to be true, it almost certainly is.

Practice safer online browsing

Browser plugins are a common source of malware. Installing them gives unknown third parties full access to your browser's window, history, and potentially your passwords and session cookies.

The best security advice is to limit if not eliminate browser plugins on the devices you use for access to sensitive accounts like crypto exchanges.

If browser plugins are absolutely required, follow these strict guidelines:

Official Sources Only: Only install plugins from official storefronts (Chrome Web Store, Mozilla Add-ons, or Apple Safari Extensions). Do not rely on the presence of an extension in these stores or positive reviews in these stores as markers of trustworthiness. Malicious browser extensions can present a strong rating until such time as the access they provide is abused.
Restrict Permissions: Configure browser plugins to only activate when clicked, or restrict them to only run on specific, necessary websites.
Regular Audits: Regularly audit your installed extensions to remove or disable unnecessary ones.
Compartmentalize: Use a completely separate, clean browser (or a strict Private/Incognito mode where all plugins are disabled) exclusively for crypto transactions and sensitive work.

Protect your crypto wallets

Safeguard your digital assets against browser compromises by using a reputable offline hardware wallet, diligently double-checking pasted addresses and enabling phishing-resistant MFA.

Advice for Okta customers

We recommend allowlisting strategies that provide security teams the ability to control the execution of third-party code on any browser used for access to corporate resources.

Two suggested approaches are provided below.

1. Deploy Managed Chrome:

Restricting local admin rights on managed company devices
Require a managed device for access to sensitive resources in Okta authentication policies
Deploy a Managed Chrome browser to user devices
Create an allowlist of approved browser extensions, removing the ability for users to add other extensions without admin approval
Create a process for users to request new extensions

2. Advanced posture checks:

Require a managed device for access to sensitive resources in Okta authentication policies
Deploy Okta Verify to user devices (using the latest version available in the Okta Admin Console)
Use advanced posture checks (part of Okta device assurance policies) to assess what browser extensions are running in the user browser at sign-in. Write authentication policies that allow access to sensitive resources from allowlisted browser extensions and deny access from all others.
Create custom remediation messages for users that are denied access to resources based on the extension running in their browser.
Create a process for users to request new extensions

Indicators of Compromise

Type	Indicator	Comment
AS Number	AS215826	Bulletproof host autonomous system serving malicious traffic
Chrome extension ID	olnppmocapoaecjhkiilemmnkjbmabfj	ShieldGuard tools extension ID
Chrome extension ID	fkogigpebmhlbldifmjngmlooifljnif	Radex extension ID

Vietnam-based cybercrime markets enable account sign-ups at scale

Mathew Woodyard, Angelos K. Marnerides, Michael Photiades, Jeremy Kirk — Sat, 28 Feb 2026 16:00:00 +0000

Executive summary

Okta Threat Intelligence, working with our partners at the University of Cyprus, have connected a cluster of fraudulent account registration activity to a sprawling cybercrime ecosystem based in Vietnam.

Fraudulent online accounts are more than just a nuisance; they are a critical tool for large-scale financial fraud. From spam to phishing to devastating interpersonal fraud scams, these accounts provide a veneer of legitimacy that allows criminals to abuse platforms and customers of those platforms.

In late 2025, Okta Threat Intelligence investigated signup fraud campaigns using infrastructure clusters internally designated as O-UNC-036 that relied on disposable email addresses in order to execute SMS pumping attacks, which is also known as International Revenue Sharing Fraud (IRSF). In this scheme, malicious actors automate the creation of puppet accounts in a targeted service provider. Fraudsters use these account registrations to trigger SMS messages to premium rate phone numbers and profit from charges incurred. This activity can prove costly for service providers who use SMS to verify registration information in customer accounts or to send multifactor authentication (MFA) security codes.

In the course of this investigation, Okta Threat Intelligence and our partners observed links from O-UNC-036 to dozens of websites that cater to individuals who want to conduct online fraud. This cybercrime-as-a-service (CaaS) ecosystem provides paid infrastructure and services that make it easier for other individuals to conduct online fraud. Many of these online storefronts sell user accounts that have been hijacked or created through automated means. This post will explain the threat that fraudulent registration poses to service providers, how it is executed and steps that can be taken to mitigate abuse.

Fuel for fraud

There is demand and a brisk trade for accounts on social media sites and services like LinkedIn, Instagram, Facebook, and TikTok. Fraudulent accounts can be leveraged in numerous ways that can impact the reputation of a service provider. Accounts can be used to send spam or to direct unsuspecting users to phishing sites. Fraudulent account registration is used to gain access to limited products such as concert tickets, to exploit free trials or manipulate product reviews. This all results in an erosion of trust in a service provider and a degraded experience for users.

Fraudulent accounts are also used to approach targets of interpersonal fraud scams: cyber-enabled crimes that range from investment and cryptocurrency scams to romance and sextortion schemes. Often referred to as "pig butchering," targets are persistently engaged online and over the phone in schemes designed to defraud them. These operations have exploded in recent years in southeast Asia, particularly in border areas near China, Myanmar, Thailand and Cambodia, and are run out of large compounds by organized criminal networks.

This activity has, according to an April 2025 report by the United Nations Office on Drugs and Crime, resulted in a "surge of specialized service providers" that feature a "range of merchants specializing in the sale of fraud kits, stolen data, malware, AI-driven tools, and various underground banking, money laundering and cybercrime services utilized by other criminals targeting victims globally."

This trade often happens in relatively open forums, on social networking sites, clear-web websites and on messaging platforms including Telegram. The tools enable fraud perpetrators to find targets, learn about them, gain their confidence and eventually cause them financial losses.

"When [scammers] use fake accounts to win the trust of people, they end up with a lot of personal data about them. They can do lots of damage to those victims," says Hieu Minh Ngo, a Vietnamese cybercrime investigator who contributed to the U.N. report and runs ChongLuaDao, nonprofit scam-fighting cybersecurity awareness organization.

The "web shops" we observed used website templates produced by a Vietnam-based web design and marketing company. We observed these cookie-cutter templates used for dozens of sites offering account-related products as well as other services used for fraud, such as falsely inflating the popularity of social media posts, phone farms for managing large numbers of accounts, residential proxies and "anti-detect" browsers, which are used to evade the tools used by security teams to detect account takeovers.

While the activity we observed predominantly targets Vietnamese speakers, many of the fake account vendors using these e-commerce templates also seek English-speaking buyers, extending the reach of this threat beyond Vietnam.

In December 2023, Microsoft undertook legal action against a Vietnamese CaaS group that sold fraudulent created Outlook and Hotmail accounts. The group, Storm 1152, created and sold 750 million fraudulent Microsoft Outlook and Hotmail accounts that were used for fraud, ransomware and extortion. The action temporarily disrupted Storm 1152. However, the group has since reformed, and Microsoft filed a second civil lawsuit in July 2024 in an effort to disrupt new infrastructure. We have not observed direct links between the activity we observed and Storm 1152.

Wanted: fake accounts

There is a chicken-and-egg problem fraudsters face when they need to create large numbers of synthetic user accounts with a service provider. Each new account requires a unique email address. Our insight into the fraudulent activity started with a set of disposable email domains used by O-UNC-036.

There are a variety of email services that offer "disposable" email addresses to cater to users with privacy concerns. These addresses can be generated en-masse and the services are often designed to cater to users that will likely only use an account for a short time. Correspondence to an address is typically available via an online service, and the email address provided may only be functional for as little as 10 minutes before being disabled. For fraudulent registrations, this arrangement is fine, since users of the service have no intention of actually using the address and may need only to view its inbox once to receive a verification code.

Okta Threat Intelligence observed a flood of suspicious-looking account registrations using multiple disposable email domains, which given the nature of the services is a red flag that the registrations are not being used for legitimate purposes. Our analysis of email provider domains turned up visual similarities that led us to a sprawl of web-based storefronts hosted in Vietnam and involved in the sales of web-based accounts.

All about MMO ("Make Money Online")

The website CMSNT.co appears similar to other marketing and website design services aimed at the e-commerce market.

"We design websites for your online money-making ventures," the site reads. "Automate your online money-making process."

What follows is a series of tiles that advertise website templates.

The website templates reveal a common theme: the sale of digital accounts for various types of services, including email providers, gaming sites, and social media services. However, there is no indication that CMSNT[.]co is involved itself in the sale of digital accounts or activity that could potentially violate computer crime laws.

Some templates are customized for the sale of accounts linked to video streaming, graphic design or AI chatbot service subscriptions, or for the sales of application software keys. Another template is a Social Media Marketing Panel, which appears to be designed as a storefront for a service that artificially boosts social media engagement on major social network sites. This inflation can include bogus "likes", comments or views. CMSNT[.]co says that "AI technology simulates real user behavior. No password required, just a public link. Trusted by over 15,000 customers."

Another template is customized for offering chron job services (scheduled tasks) using python, which can be used for tasks like web scraping.

Our research revealed that CMSNT[.]co's templates are used by dozens of websites. But not everyone is paying CMSNT[.]co to use them. At some point the source code for some templates was leaked, resulting in some entities using the templates without paying for licenses.

One of those freeloaders is Via17[.]com. "Via" is a slang term for hacked accounts, and it appears frequently on sites that are selling accounts. The compromised accounts may have been acquired using brute-force techniques, where attackers try different combinations of usernames and passwords, or from "logs" collected by information stealer (infostealer) malware. These types of malware logs, which can contain login credentials, payment card details, cryptocurrency wallet information and personally identifiable information extracted from infected devices, are routinely sold on underground forums and messaging platforms.

In an instructional video on YouTube, a person affiliated with the site bills Via17[.]com as the "#1 reputable website providing Facebook accounts." The video focuses on how people can access a Facebook account using a session token, which is a small data file that allows a user to remain signed into a website. Via17[.]com sells session tokens (also referred to as "cookies") as part of some fake account offerings.

One of the primary products at Via17[.]com is the resale of accounts from social networking sites. One package offers Vietnamese Facebook accounts with 10-50 friends with two-factor authentication enabled. More than 1,000 accounts are available at a price of 55,240 Vietnamese dong, or US$2.13 each. Other tiles advertise "vintage" Facebook accounts as old as 2006. Some accounts are listed as "real" accounts. It is unclear how Via17[.]com or its users have acquired them prior to sale. "Clone" accounts are created by software, according to the site. Depending on the type of account purchased, the data provided includes a userid, password, the ability to collect 2FA codes or notifications, a recovery email address and session tokens.

A similar account marketplace is nladsgiare[.]shop, which also runs the CMSNT[.]co website code. The advertisements for accounts on this site show the role that disposable email accounts play in the account trade. A section of the front page of the site advertises Facebook accounts that have Thai or "foreign" names that are linked to disposable email addresses from a service called mailclone[.]site.

Anyone can generate an email address on mailclone[.]site. Content sent to the address - such as an email verification link - is visible directly on the site. The same style of verification is recommended for accounts on Via17[.]com, with the site recommending buyers get codes sent to accounts from another free, temporary e-mail service, temp-mail[.]io.

Via17[.]com recommends 11 other disposable email services that can be used for account registration.

Conclusion

Preventing fraudulent account registration is a careful balance between preventing fraud and introducing undue friction on customers. (Users may be legitimately using masking or email forwarding services - consider Apple's Hide My Email feature). Organizations are typically prepared to tolerate a certain level of fraud to avoid events in which potential customers cannot complete a registration - this must be balanced against the risks an abundance of bogus accounts poses via a degraded customer experience.

Mitigations

Auth0

Auth0 customers have several tools at their disposal to mitigate fraudulent signups before, during and after the account creation process. Okta Threat Intelligence has written a playbook to guide efforts to mitigate abuse.

To protect their tenants from signup attacks, Auth0 customers can:

Use Bot Detection to challenge bots with a CAPTCHA of your choice within the configured risk tolerance.
Tighten Suspicious IP Throttling limits on signup to reduce the number of accounts attackers can make from individual IPs.
Create a Tenant Access Control List (ACL) rules, which denies observed malicious activity from sources based on indicators such as IPs, ASNs, geolocation values and JA3/JA4 signatures and has been shown to help mitigate signup attacks.
Enforce email verification using post-login Actions or a one-time password.
Block registrations that use known disposable email domains with pre-user registration actions.
Detect signup attacks with Auth0's open source Security Detection Catalog, especially the rules detecting risks of signup fraud by disposable domains and by volume and mass unverified account creation events.
Implement identity proofing tools, like those in the Auth0 Marketplace.

Okta Customer Identity

Okta Customer Identity also has controls that can be used to mitigate fraudulent sign up. Customers can block attackers before, during and after the signup process:

Identity Threat Protection, which is now in early access for Okta Customer Identity, evaluates IP reputation and looks at behavioral signals to block scripted account signups and signins and detect when threat actors use compromised credentials to sign up for accounts.
Use Okta APIs or Workflows to identify large batches of fraudulent registrations. Okta has published a sample workflow specifically to manage the abuse of self-service registration. The workflow compares the email address from a registration attempt and runs it against a customer-defined list of malicious or disposable domains. The workflow can be configured to deactivate these accounts.
Consider forcing verification of newly registered accounts via email link or OTP validation.

Consider performing identity-proofing with specialist third-party providers for users of high value services.
Consider blocking the most risky anonymizers and proxies by leveraging enhanced dynamic network zones. This stops attackers from reaching registration pages from high-risk services. Network blocking is the most extreme response and may not be an option for some.

Universities exposed to account takeover risk from contract cheating services

Mon, 16 Feb 2026 08:00:00 +0000

Executive Summary

Okta Threat Intelligence has identified extortion campaigns that target university students.

These operations often masquerade as "tutoring" or "proctoring" services, but function as contract cheating operations that feed sophisticated identity-theft and financial-crime rackets.

These extortion campaigns appear to first involve local and online recruiting efforts that seek students as clients.

In order for third parties to complete academic work on behalf of a student, students are asked to facilitate access for the proctoring services to academic systems, in some cases by sharing authentication credentials.

These third parties then press the students for further payment by threatening to expose the student for cheating.

The extortionists have been observed logging in from VPNs, residential, and mobile IP addresses in Kenya.

Okta Threat Intelligence has collaborated with several universities and people to study this activity, including Glen Woolley, Andrew Tolhurst, and Damien Mathieson of the Cyber Security Operations team at the University of Sydney.

This is not merely a matter of academic integrity; it is a threat to student safety and standards, the university's security perimeter and as one research institute posits, national security.

These extortion schemes target students across numerous universities in the English-speaking world, including the United States, Canada and Australia. Merely providing academic cheating services is illegal in some jurisdictions. For example, Australia criminalized contract cheating and ordered ISPs to block 555 websites offering these services. Regardless of jurisdiction, extorting students under threat of exposure is illegal.

There are broader risks to universities because of how the academic work is completed. Attackers demand full access to student accounts, which could mean the transfer of login credentials and approval of multifactor authentication challenges or other kinds of remote access. This grants threat actors an ongoing foothold within the university's environment.

While Okta Threat Intelligence has not directly observed a pivot from extortion to other abuses of student access in the clusters we are tracking, threat actors could conceivably leverage and monetize their access to achieve objectives such as payroll piracy.

Okta is committed to helping customers, partners, and users understand the critical role identity security plays in these attacks.

From contract cheating to student extortion

In order to finish their academic work quickly with minimal effort, some students choose to engage third parties to complete academic tasks in their behalf.

It is only after one of these third parties submits an assignment on behalf of a student through university apps like Canvas and Blackboard that the extortion component of these campaigns commences.

For instance, a student may pay $75 for one assignment, but after the assignment is submitted, the threat actor demands a further payment of $1,000 under threat of reporting the student. In almost all cases where the victim doesn't pay, the malicious actor will report the student. The malicious actor records voice and video communications with the student and may send emails to administrators.

Critically, the extortionists have leverage against their victims. Identity and access management logs may indicate that someone else has been using the student's account. The IP logs could show "impossible travel," meaning a student account was accessed locally and then some time later from a locale it would have been impossible for the student to now be located.

Lure mechanisms: the "academic support" facade

Threat actors use a multi-channel approach to find victims, often tailoring their language and platform to specific student demographics. The extortionists thrive in high-pressure moments, such as during finals week or mid-terms.

These services are advertised using both digital and physical channels.

Digital channels

The most common lures are digital, designed to look like academic notifications or helpful peer-to-peer recommendations.

Marketing emails: Attackers send emails to students with subjects like "Struggling with your Final?" or "Expert Tutors Available - Guaranteed A+." These often use professional-looking signatures to mimic official academic support messages.
Direct messaging (WeChat, WhatsApp, Telegram): To overcome email controls enforced by many universities that are likely to block, flag or filter out spam, attackers also use popular messenger apps used by international student communities. These messages are often written in the student's native language.
Websites: Contract cheating services develop professional-looking websites to give themselves an air of legitimacy.

Physical channels

Campus Postings: Accomplices of the attackers place physical flyers around campus.

Coerced referrals: Once a student is already being extorted, the threat actor may demand that the student recruits more classmates. This turns the victim into an accessory, spreading the lure through trusted peer networks.

Campaign Objectives

The primary objective of these campaigns is financial crime, achieved by extorting students based on evidence of authorized access.

The observed activity demonstrates clear intent to put students in a compromising situation in which they are either forced to pay or risk consequences from their academic institution.

Data collected by threat actors

The malicious actors try to collect as much personal information as possible to ensure the success of their extortion plot. These actors collect data such as:

Personally identifiable information (PII): Full name, home address, and phone number.
Institutional identifiers: Student ID number and official university email address.
Academic evidence: The assignment prompts, the student's personal notes, the completed assignment and even the course syllabus.
Proof of presence: Screen recordings or screenshots of the attacker logged into the student's portal (Canvas, Blackboard, etc.)

Risks beyond student extortion

Universities and Colleges are attractive targets for financially-motivated cybercriminal groups. We assess that contract cheating and extortion services have the potential to expose institutions to additional fraudulent activity if the extortionists we observed were to capitalize on the persistent access to systems granted by students.

Payroll piracy: The same credentials used to access student portals may provide access to payroll systems in those circumstances where a student also performs work for the institution. With access to payroll accounts, attackers can change bank routing information before a pay cycle, redirecting a student's wages to attacker-controlled accounts.
Financial aid fraud: The same credentials used to access student portals may provide access to financial aid portals, providing opportunities to divert loan disbursements or apply for additional fraudulent grants in the student's name.
Phishing and spam: Threat actors may also choose to abuse the high reputation of a trusted .edu email address to bypass spam filters and target faculty, staff, or administration in an attempt to gain access to higher-privileged accounts.
Research and IP Theft: The same credentials used for access to student portals may provide access to proprietary university databases, journals, or sensitive research data in specialized fields like defense and biotechnology.
Student discount harvesting: Threat actors may abuse student identities to resell products and services purchased with a student discount.

Threat Response

What we're doing

Okta is taking the following actions to mitigate this threat:

Proactively notifying institutions when we detect suspicious activity.
Providing guidance and assistance to organizations to enhance the security of their Okta environments and assisting them to investigate any suspicious activity related to potentially compromised accounts.
Maintaining ongoing working groups with higher education institutions.

Detections

In order to reach their objectives, attackers must have persistent access to the student's account long enough to run their extortion operation.

If the university is using Okta as an Identity Provider, there are several technical indicators that can point to evidence of unauthorized account takeovers.

What follows is a summary of detections available in the Okta platform.

Authenticator reuse: Attackers frequently register the same physical hardware such as a mobile phone to register as an MFA factor for multiple accounts that have been compromised. Analysts may see several student identities associated with the same device identifier in Okta logs, which is a strong sign of multiple account takeovers. Okta has a detection in the Customer Detection Catalog on GitHub for authenticator reuse here.

Session initiated by user, completed by attacker: This behavior involves the attacker logging in using the student's credentials from a remote location. However, the MFA prompt, such as a push notification, is accepted by the student from their normal IP geolocation. This creates a session where the root session ID originates from a suspicious IP while the successful authentication success comes from a trusted IP. Okta has created a detection for this scenario here.

Impossible travel: Student accounts that have been shared with contract cheating services will often show evidence of impossible travel. We routinely observe impossible travel scenarios where a student account logs in from their expected campus location but the event is followed almost immediately by a login from an IP address geolocated to Kenya, India or Pakistan. Often these aberrant IPs will solely login to Canvas, Blackboard or other assignment submission sites. Okta has a detection in the Customer Detection Catalog for impossible travel that is paired with a detection for a new device. Together, those are two key signals of a possible account takeover.

Intentional use of proxy services: Rather than merely being sloppy, we have observed threat actors intentionally use suspicious proxy services and IPs. This is part of their extortion operation: attackers leverage the impossible travel as evidence they can show university administrators. Use of IPs from unexpected locations, especially India and East Africa, can be indicative of an account takeover. Okta has a hunt in the Customer Detection Catalog for sign in attempts from proxies that customers can leverage.

Recommendations for Okta Customers

Utilize authenticator enrollment policy to block device enrollment to specific geo-locations and to block enrollment from proxy services
Block proxy services listed under the Network Indicators section below using dynamic network zones.
Block login or require step-up authentication from high risk or unexpected locations.

Network Indicators

Okta Threat intelligence has observed suspicious patterns of account access originating from Kenyan IPs. These IPs are not contained within one ASN, but frequently are associated with known suspicious proxying services:

RAYOBYTE_PROXY
NEXUS_PROXY
PROXYRACK_PROXY
IPCOLA_PROXY
KOOKEEY_PROXY
PLAINPROXIES_PROXY
LUMINATI_PROXY
9PROXY_PROXY
PROXYAM_PROXY
IPIDEA_PROXY
ABCPROXY_PROXY
NETNUT_PROXY

A note on estimate language

Okta Threat Intelligence teams the following terms to express likelihood or probability as outlined in the US Office of the Director of National Intelligence Community Directive 203 - Analytic Standards.

Likelihood	Almost no chance	Very unlikely	Unlikely	Roughly even chance	Likely	Very likely	Almost certain(ly)
Probability	Remote	Highly improbable	Improbable	Roughly even odds	Probable	Highly Probable	Nearly Certain
Percentage	1-5%	5-20%	20-45%	45-55%	55-80%	80-95%	95-99%

Detecting OpenClaw using advanced posture checks

Rafa Bono — Mon, 09 Feb 2026 16:00:00 +0000

OpenClaw is a free and open-source "personal AI assistant" that a user can connect to the local resources on their computer, messaging applications, calendars, and anything else they want the agent to access.

Right now, at least one of your users is experimenting with a personal assistant like OpenClaw. How you feel about that depends largely on the risk appetite of your organization, and how quickly you can spin up resources to assess the risk of this week's AI buzztoy. This stuff is coming at us fast.

A "personal AI assistant" doesn't need to be malicious or vulnerable for you to want to wrap some policy around its use on corporate-issued devices.

The facts are:

Personal AI assistants, by their nature, will seek broad system access - interacting with files, processes, and network resources - which makes it a powerful tool if it were ever abused.
Personal AI assistants may install persistence mechanisms like launchd services and binaries across multiple paths, making them difficult to fully remove.
The default listening port for these personal assistants could be exploited for remote access to your device or command-and-control.

The most conservative option would be to block the use of these technologies until your team has had some time to figure out how to use them safely. (See these tips from the Auth0 team if you're experimenting with OpenClaw).

You may also want to make access decisions for specific resources based on whether an AI assistant is downloaded, installed, or actively listening on a device used to access enterprise resources.

That's where Okta advanced posture checks can play a role. Advanced posture checks incorporates osquery-based posture evaluations on any device running admin-issued versions of the Okta Verify client.

By integrating detection queries like the samples provided below into advanced posture checks, organizations can automatically evaluate device health at authentication time and enforce access policies that, for example:

Block or restrict sign-ins from devices where OpenClaw is detected
Deny access to specific sensitive resources (apps) from devices where OpenClaw is detected
Trigger workflows that notifies administrators of a detection.

In all cases, administrators can create customized remediation advice for the user. Users can be instructed to take the actions necessary to restore access to specific resources, without having to call the IT helpdesk.

Sample queries

Let's assume OpenClaw is the personal AI assistant you want to check for. There are a number of approaches to detecting its use on a MacOS device.

Launchd

Let's start with persistent services/daemons by searching launchd for the term "OpenClaw". OpenClaw can be configured to launch at startup before you've even opened your terminal. This is part of the reason why personal AI assistants make people very, very nervous.

SELECT 1 AS result FROM (

    SELECT path

    FROM launchd

    WHERE name LIKE '%openclaw%'

    LIMIT 1);

Files

Advanced posture checks can also search for the presence of configuration files and binaries in common installation paths.

SELECT 1 AS result FROM (

    SELECT path

    FROM file

    WHERE path LIKE '/Users/%%/.openclaw/openclaw.json'

        OR path LIKE '/%%/.openclaw/%'

        OR path LIKE '/Users/%%/.volta/bin/openclaw'

        OR path LIKE '/Users/%%/.nvm/current/bin/openclaw'

        OR path LIKE '/usr/bin/openclaw'

        OR path LIKE '/usr/local/bin/openclaw'

        OR path LIKE '/opt/homebrew/bin/openclaw'

        OR path LIKE '/Applications/OpenClaw.app'

    LIMIT 1);

Running processes

Perhaps you're less concerned by whether OpenClaw has ever run on the machine, and more concerned about whether it's running while a user is signing in to protected resources?

SELECT 1 AS result FROM (

SELECT path

    FROM processes

    WHERE name LIKE '%openclaw%'

        OR cmdline LIKE '%openclaw%'

    LIMIT 1

);

Homebrew packages

OpenClaw leans on Homebrew for access to system-level dependencies. The presence of a homebrew installation with the name "OpenClaw" is another breadcrumb to follow.

SELECT 1 AS result FROM (

    SELECT path

    FROM homebrew_packages

    WHERE name LIKE '%openclaw%'

    LIMIT 1

);

npm package checks

The presence of an npm package of the same name also offers a detection opportunity.

SELECT 1 AS result FROM (

    SELECT path

    FROM npm_packages

    WHERE name LIKE '%openclaw%'

    LIMIT 1

);

Listening ports

By default, OpenClaw listens on several network ports:

18789 (TCP): The main port for the WebSocket Gateway, which coordinates connections between clients (CLI, web UI, mobile apps) and the AI agent.
18791 (TCP): Used for browser-based control/dashboard access.
9090: The application often defaults to using port 9090 for its service mode. Users frequently deploy OpenClaw using Docker containers, where mapping this port is necessary to access the service, commonly using 0.0.0.0:9090.

SELECT 1 AS result FROM (

    SELECT path

    FROM listening_ports

    WHERE port IN

('9090', -- Default OpenClaw self-hosted port.

'18789', -- The main port for the WebSocket Gateway.

'18791' -- Used for browser-based control/dashboard access.

        OR  path LIKE '%openclaw%'

    LIMIT 1

);

Installed applications

Advanced posture checks can also simply check if an app of this name is installed on the (MacOS) system.

SELECT 1 AS result FROM (

    SELECT path

    FROM apps

    WHERE name LIKE '%openclaw%'

        OR bundle_identifier LIKE '%openclaw%'

    LIMIT 1

);

Docker images

Advanced posture checks can also check for whether OpenClaw is running in a container. Here is a check for Docker images that use the name "OpenClaw"...

SELECT 1 AS result FROM (

    SELECT id

    FROM docker_images

    WHERE tags LIKE '%openclaw%'

    LIMIT 1

);

Docker containers

SELECT 1 AS result FROM (

    SELECT id

    FROM docker_containers

    WHERE image LIKE '%openclaw%'

    LIMIT 1

);

All together now

Given many of these detections rely on mutable names, a single query (or even two) might be prone to false positives. You may find that a few in combination deliver more consistent results.

The final query I'll leave you with attempts to detect the presence of OpenClaw on a macOS device by examining multiple system sources and combining the results into a single detection score.

Each source contributes a count of matches. These counts are summed into a final score:

Score ? 2 ? openclaw_detected = 0 (insufficient confidence of detection)
Score > 2 ? openclaw_detected = 1 (confident detection)

The threshold of 2 helps avoid false positives by requiring multiple indicators before flagging a device.

WITH launch_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM launchd

    WHERE name LIKE '%openclaw%'

),

 file_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM file

    WHERE path LIKE '/Users/%%/.openclaw/openclaw.json'

        -- OR path LIKE '/%%/.openclaw/%'

        OR path LIKE '/Users/%%/.volta/bin/openclaw'

        OR path LIKE '/Users/%%/.nvm/current/bin/openclaw'

        OR path LIKE '/usr/bin/openclaw'

        OR path LIKE '/usr/local/bin/openclaw'

        OR path LIKE '/opt/homebrew/bin/openclaw'

        OR path LIKE '/Applications/OpenClaw.app'

),

 claw_process AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM processes

    WHERE name LIKE '%openclaw%'

        OR cmdline LIKE '%openclaw%'

),

 homebrew_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM homebrew_packages

    WHERE name LIKE '%openclaw%'

),

 npm_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM npm_packages

    WHERE name LIKE '%openclaw%'

),

 netports_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM listening_ports

    WHERE port IN

('9090', -- Default OpenClaw self-hosted port.

'18789', -- The main port for the WebSocket Gateway.

'18791' -- Used for browser-based control/dashboard access.

        OR  path LIKE '%openclaw%'

),

 apps_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM apps

    WHERE name LIKE '%openclaw%'

        OR bundle_identifier LIKE '%openclaw%'

),

 docker_image_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM docker_images

    WHERE tags LIKE '%openclaw%'

),

 docker_container_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM docker_containers

    WHERE image LIKE '%openclaw%'

),

 final_score AS (

     SELECT

        + file_claw.total

        + claw_process.total

        + homebrew_claw.total

        + npm_claw.total

        + netports_claw.total

        + apps_claw.total

        + docker_image_claw.total

        + docker_container_claw.total

        AS score

     FROM launch_claw, file_claw, claw_process, homebrew_claw, npm_claw, netports_claw, apps_claw, docker_image_claw, docker_container_claw

 SELECT

    CASE

        WHEN score <= 2 THEN 0

        WHEN score > 2 THEN 1

    END AS openclaw_detected

 FROM final_score

More clawsome detections

Detecting the presence of a new and unverified application like OpenClaw is one of numerous ways in which advanced posture checks can be used to ensure resources are only accessed from devices exhibiting strong hygiene.

Stay tuned for more!

The North Korean on your payroll

Wed, 28 Jan 2026 16:00:00 +0000

In September 2025, Okta Threat Intelligence published research from a large-scale analysis into fraudulent employment schemes conducted by Democratic People's Republic of Korea (DPRK) IT Workers (ITW).

That research collated data from over 130 actors, conducting over 6500 interviews with 500 companies.

In this post, we look specifically at the activities of two individual personas. We selected these two examples from a large list of actors that we continue to track because they exemplify the typical tools, techniques and procedures (TTPs) employed by DPRK ITW actors. Additionally, each had novel observables that can further inform defenders against these efforts.

These two actors reveal two interesting TTPs DPRK actors use to land employment: the abuse of legitimate LinkedIn profiles to pass reference checks, and the abuse of stolen identities.

#1 - Meet "JJ"

The first of the two actors we will detail we'll refer to as "JJ". This actor has prolifically interviewed for roles in multiple verticals over two years, with an overrepresentation of roles in AI and healthcare.

The email account used by this actor is similar in structure to other DPRK-linked actors, in that it utilizes a free webmail service and the account name incorporates references to software development and other randomized alphanumeric characters. Open-source intelligence (OSINT) research conducted into the email address used by this actor uncovered a number of online services accounts that are very typical of DPRK ITW actors. All of these accounts are used exclusively for job applications and associated tasks:

Job board and hiring platforms
Scheduling platforms popular with recruiters
Document organization workspaces with AI assistance
Dynamic DNS services
Online coding platforms

While not observed with this specific actor, Okta Threat Intelligence has also used OSINT techniques to observe email addresses used by DPRK actors being registered to the following services:

Freelancer employment platforms
Article authoring and publishing platforms
Document creation and managements
Language learning platforms
Online communications
Software development social platforms
Online PDF platforms
Coding assessment platforms

DPRK actors use these online accounts and fabricated resumes to effectively create an artificial "persona". These personas appear "out of thin air", inheriting the online presence required for a professional applying for roles, but without any evidence of personal use of any internet services. The exclusive use of these specific services, combined with the absence of any personal online footprint, creates a pattern highly indicative of an artificial persona.

Additional "tells" very common to these actors can sometimes be observed in the document properties of PDF resumes they provide. Okta Threat Intelligence can provide customers with further details on these methods of detection - please talk to your account manager to find out more.

Becoming JJ

During the two years of observed activity, our threat actor JJ created and subsequently abandoned several personas.

Until recently, JJ told recruiters that he did not have a LinkedIn profile. Okta Threat Intelligence occasionally observes LinkedIn profiles associated with the persona email addresses set up by DPRK ITW actors. The scarcity of connections, posts, recommendations, other content, and activity on these profiles can be used to identify a lack of authenticity. Often we discover that a LinkedIn profile listed by a DPRK ITW actor has been disabled thanks to the detection and enforcement efforts of the LinkedIn security team.

In September 2025, JJ was observed providing recruiters an active LinkedIn profile for the first time. The LinkedIn profile matched the inauthentic name they were using to apply for roles at the time, and doesn't feature a profile picture. At first glance, the LinkedIn profile appeared robust and realistic, unlike most LinkedIn profiles established for DPRK IT Worker fraud. For example, the profile had:

Almost 200 connections
Links to a GitHub account with realistic content (see later in report for example of an unrealistic GitHub account)
Multiple "skills" listed, many of which were endorsed by multiple third-parties. The endorsing LinkedIn accounts appeared to be authentic.

A happy false-positive

Our investigation determined that the person represented in the LinkedIn profile was, until recently, a genuine employee of the listed organization.

Our assessment is that the actor has simply misrepresented a genuine Linkedin profile as their own, altering the name of their fraudulent persona to fit that of a real human to align with the employment criteria. Our confidence in this assessment was also based on the fact that the DRPK actor's email address was not the email address used for the legitimate LinkedIn profile. It was a form of "stolen valour" designed to increase their chances of employment.

A challenge for verification

This technique - creating a persona based on a real identity - reinforces the need for strong identity verification prior to any form of employment. Employers should not rely on a LinkedIn profile as a basis for determining employment history. Verification requests to current or recent employers, asking only if a person with that name was employed in the role in the timeframes listed on LinkedIn, will not reveal the fraud. It is trivial for a threat actor to employ this technique, or to generate resumes directly from a co-opted Linkedin profile using an online resume generator or an AI-augmented system that consumes a public profile as an input. The actor simply creates an altered email address and phone number and makes the task of an HR screener far more demanding.

Prospective employers should incorporate identity verification techniques such as mobile drivers license verification. If relying on knowledge factors, verifiers should only base assessments on definitively non-public information such as partially-redacted national ID number or the name of the last manager at the role. Employers cannot rely on date of birth for robust verification as this information is readily available in public data and people-search services.

#2 "EM" gets hired

We will refer to our second actor as "EM". EM's employment fraud activity stretches back over a year, with hundreds of interviews again across all verticals, but very much favoring AI-related roles and organizations. Okta Threat Intelligence also observed EM interviewing with sensitive critical national infrastructure (CNI) organizations such as commercial aviation, communications providers, internet service providers, a voting technology company and intelligence and defense contractors.

EM has a statistically high occurrence of succeeding in first interviews and being offered multiple rounds of interviews with individual organizations, and is likely to have been hired by several organisations into software development roles.

We set out to discover some of the secrets to EM's success.

The co-opted persona used by EM appears to have been crafted based on an online photograph of a legitimate person who unfortunately also displayed enough information online to enable the DPRK (and potentially others) to co-opt his identity.

The real EM and an identity problem

EM claims to be a US citizen when asked about employment eligibility, and presents very realistic identity documents. Research into the name used by this actor finds that there is only one real person with this distinct name. We found photos of a person, holding up an identity document almost identical to the document our actor presents as his own, with a different photograph and signature.

The DPRK EM

EM's professed residential and employment history differs significantly from that of the real person whose identity was assumed. Okta Threat Intelligence observed EM offering two different contact phone numbers. Both are VoIP phones - ubiquitous with DPRK actors - and one has a Caller ID location that contradicts their professed biography. The LinkedIn profile listed in their resume has since been taken down by the team at LinkedIn.

lookup cname = SEATTLE WA
lookup cname = WESTPORT WA

DPRK ITW actors often create impressive-looking GitHub accounts to backstop their technical proficiency for job interviews. EM is no exception to this.

A GitHub account used by EM has thousands of contributions, ostensibly dating back to 2011.

However it appears that EM forged most of the commit dates .

The actual earliest contribution date from EM in this account can be determined using the GitHub API (see request response below), which returns a date of December 2024, not 2011.

?  ~ curl -s https://api.github.com/repos/em???????/D??????-W?????? | jq -r '.created_at'

2024-12-14T??:??:00Z

This actor simply changed the year of their unsigned commit date from 2024 to 2011.

The many (AI) faces of EM

The face of EM, as presented in various online profiles, is inconsistent. None of them are at all similar to the image used in EM's forged identity documents.

They appear to the human eye as likely AI creations, and multiple online AI-detection tools offer mixed-high confidence assessments when asked if the profile pictures were AI generated.

A third profile picture, likely sourced from a now-deleted LinkedIn account, lacks the necessary resolution to accurately determine if it was AI-generated. It is again clearly not the same as the forged identity or other AI-generated images used by the actor.

The other DPRK EM?

During the course of our research, Okta Threat Intelligence assessed two additional professional profiles with a distinctly different biography and profile picture that tools identified as likely not being AI-generated.

As the table below shows, the two profiles show a very different story. This may be a different DPRK ITW actor using the same identity, or an earlier iteration of EM's fictional biography.

Your new (DPRK) hire

During our research, we often make assessments as to whether a DPRK ITW actor has successfully been hired into a role. In this case we can say with high confidence that EM has been hired: thanks to a LinkedIn post by their new employer, welcoming their newest hire.

The photo used in this post is even more obviously AI-generated than any of the other photographs we analyzed.

Steps have been taken to contact this organization to inform them of our observations.

Conclusion

Just as with genuine candidates hunting for work, the vast majority of interviews with DPRK facilitators and agents do not progress to a second interview or job offer.

Some actors however seem to be more competent at crafting personas and passing screening interviews. Their skill isn't limited to an ability to impress a prospective employer, but also to the tools and techniques that DPRK ITW actors use to try to obfuscate their actual origins.

Given the vast quantities of job applications and interviews being conducted, the various operators in the IT Worker scheme are clearly "learning from their mistakes" - in many cases duplicating approaches (CV structure and elements, Linkedin profile construction and interview support technologies) that have succeeded in progressing one application over another. A kind of IT Worker natural selection is at play. The most successful actors are very prolific, and scheduled hundreds of interviews each. We consider it likely that they often act as "interview brokers" in order to land employment positions that are then handed over to other DPRK ITW actors.

The third-party contractor risk

Our research revealed a large number of DPRK IT Workers seek temporary contract work as software developers hired out to third-party organizations. We assess that these companies are potentially less likely to enforce rigorous background checks on these short-term fixed task employees than the companies that they are contracting to would for direct-hire employees.

This highlights the importance of performing such checks not only on direct-hire employees, but also on all individuals given access to company resources via third-party service providers.

Background checks can never be optional

In this report we've highlighted an example of the deliberate co-option of the identity of a genuine person, together with their professional history. Rigorous background checking and employment verification will be needed to pierce this identity misrepresentation. Yet we also observed the hiring of an actor whose artificial identity would not stand up to even the most cursory use of a search engine.

Organizations that unwittingly hire a DPRK actor risk a potential de facto breach of sanctions obligations and associated legal exposure. Each compromised hire can also provide the DPRK with:

Direct financial gain (salary payments diverted to the regime)
Privileged internal access to sensitive systems, data, and networks
Operational leverage for ransomware, extortion, or follow-on cyber activity
Loss of commercially-sensitive corporate secrets
Strategic intelligence collection and access to support future offensive operations

Organizations should therefore adopt a layered defense, including rigorous identity verification during recruitment, ongoing monitoring of the access and behaviour patterns of remote workers, and a clear incident response plan for managing insider or supply chain threats. When hiring for positions of elevated trust and access, in-person verification of identity and documents and collection/provision of equipment and access tokens is a relatively small cost given the risk the organization is taking on. Access for remote employees and especially third-party contractors should be strictly limited to the minimum required to perform their role.

Steps to take to counter this threat

Okta Threat Intelligence assesses that organizations across all verticals - particularly those advertising remote or contract roles - should adopt a layered and proactive approach to recruitment, onboarding, and insider-threat monitoring. Okta recommends that organizations:

1. Strengthen applicant identity verification

Require verifiable government-issued ID checks at multiple stages of recruitment and employment
Cross-check stated locations with IP addresses (include VPN usage detection), time-zone behaviour, payroll banking information and delivery addresses provided for shipping hardware.
Use accredited third-party services to authenticate identity documents, prior employment, and academic credentials

2. Tighten recruitment & screening processes

Train HR and recruiters to identify red flags. Encourage processes that would identify whether a candidate is swapped out between rounds of interviews. Teach them to identify behavioural cues such as poor knowledge of the area they claim to reside in, a refusal to meet in person, a refusal to turn on camera or remove background filters during interviews, or interviewing using a very poor internet connection. Identify duplicated resumes, inconsistent timelines, mismatched time zones and unverifiable references. Assess the candidate's online footprint and social media presence against the information provided. Where evidence of previous work is provided, investigate whether these projects were simply cloned from the repositories of legitimate user profiles.
Verify the history of edits to CVs and PDFs in document metadata and other technical "tells" associated with duplication and reuse.
Add structured technical and behavioural verification (live coding or writing performed under recruiter observation).
Require corporate email references (not free webmail) and confirm via outbound call to the main switchboard numbers of the reference organization. Ensure these references incorporate elements other than revealed in for example public LinkedIn profiles, such as last-manager's name.

3. Enforce role-based and segregated access controls

Default new or contingent workers to least-privilege profiles and unlock additional access once probationary checks are complete.
Segment development, testing and production; require peer review and approval workflows for code merges and deployments.
Monitor for anomalous access patterns (large data pulls, off-hours logins from unexpected geos/VPNs, credential sharing).
Employ access certification campaigns to govern ongoing access.

4. Monitor contractors and third-party service providers

Where possible, contractually mandate ongoing identity verification standards, background checks, strong authentication policies, device-security baselines and rights to audit.
Require named-user accounts (no shared logins or internal service accounts where possible) and separate tenant/project access for each client environment.

5. Implement insider-threat and security awareness programs

Establish a dedicated insider-risk function or at least a working group spanning HR, Legal, Security, and IT.
Provide targeted training for recruiters, hiring managers, and technical leads on ITW tradecraft and screening controls.
Educate and empower hiring managers and staff members to observe and submit reports of potentially strange behaviour by their peers that raise questions as to their identity, goals, and locations.
Create safer reporting channels for suspicious behaviour or candidate concerns.

6. Coordinate with law enforcement and industry peers

Share indicators of compromise and suspicious candidate patterns with national cybercrime units and ISAC/ISAO groups.
Develop methods for the "insider-risk" group to receive and action indicators (email addresses, IP addresses, VPN providers, document creation, and behavioural indicators) and be prepared to "share back" relevant findings.
Actively participate in information-sharing forums to track evolving ITW tactics and tooling.

7. Conduct regular risk assessments and red-team exercises

Model insider and malicious contractor attack paths; quantify potential business impact.
Perform red team exercises that test the hiring pipeline (simulated DPRK application and interviews) to assess identity verification processes.
Update incident response plans to include scenarios involving malicious insiders, compromised contractors, and expedited access revocation.

Okta Threat Intelligence appreciates the assistance of Epieos in the research for this post.

Phishing kits adapt to the script of callers

Thu, 22 Jan 2026 08:00:00 +0000

Okta Threat Intelligence has detected and dissected multiple custom phishing kits that have evolved to meet the specific needs of voice-based social engineers ("callers") in vishing campaigns.

These custom kits are made available on an as-a-service basis and are increasingly used by a growing number of intrusion actors targeting Google, Microsoft, Okta and a range of cryptocurrency providers.

The kits are capable of intercepting the credentials of targeted users, while also presenting the supporting context required to convince users to approve MFA challenges, or to take other actions in the interests of the attacker on the phone. They can be adapted on the fly by callers to control what pages are presented in the user's browser, in order to sync with the caller's script and whatever legitimate MFA challenges the caller is presented with as they attempt to sign-in.

"Once you get into the driver's seat of one of these tools, you can immediately see why we are observing higher volumes of voice-based social engineering," said Moussa Diallo, threat researcher at Okta Threat Intelligence. "Using these kits, an attacker on the phone to a targeted user can control the authentication flow as that user interacts with credential phishing pages. They can control what pages the target sees in their browser in perfect synchronization with the instructions they are providing on the call. The threat actor can use this synchronization to defeat any form of MFA that is not phishing-resistant."

Okta Threat Intelligence has published a detailed threat advisory for customers that provides an inside look at the capabilities of two such kits used by intrusion actors. This blog post summarizes the key features that make these kits so effective.

When all else fails, hit the phones

The phishing kits appear, based on common features, to have evolved from the same lineage to specifically meet the needs of callers that are interacting with targeted users in real-time.

The most critical of these features are client-side scripts that allow threat actors to control the authentication flow in the browser of a targeted user in real-time while they deliver verbal instructions or respond to verbal feedback from the targeted user. It's this real-time session orchestration that delivers the plausibility required to convince the threat actor's target to approve push notifications, submit one time passcodes (OTP) or take other actions the threat actor needs to bypass MFA controls.

Attacks tend to follow a similar sequence:

The threat actor performs reconnaissance on a target, learning the names of users, the apps they commonly use, and phone numbers used in IT support calls;
The threat actor sets a customized phishing page live and calls targeted users, spoofing the phone number of the company or its support hotline;
The threat actor convinces the targeted user to navigate in their browser to the phishing site under the pretext of an IT support or security requirement;
The targeted user enters their username and password, which is automatically forwarded to the threat actor's Telegram channel;
The threat actor enters the username and password into the legitimate sign-in page of the targeted user and assesses what MFA challenges they are presented with;
The threat actor updates the phishing site in real-time with pages that support their verbal ask for the user to enter an OTP, accept a push notification, or other MFA challenges.

This real-time session orchestration provides a new level of control and visibility to the social engineer. If presented a push notification (type of MFA challenge), for example, an attacker can verbally tell the user to expect a push notification, and select an option from their C2 panel that directs their target's browser to a new page that displays a message implying that that a push message has been sent, lending plausibility to what would ordinarily be a suspicious request for the user to accept a challenge the user didn't initiate.

It's worth noting that these hybrid phishing operations are also capable of bypassing push notifications that use number challenge/number matching as an additional method of verification. Push with number matching/challenge is not phishing-resistant by definition, as a social engineer interacting on the phone with a targeted user can simply request a user to choose or enter a specific number.

By contrast, users that are required to sign in with phishing resistant methods such as Okta FastPass or FIDO passkeys are protected from these attacks.

This is how it's done now

Diallo predicts that we're only at the beginning of a wave of voice-enabled phishing attacks, augmented by tools that provide real-time session orchestration.

"Vishing is becoming such an in-demand area of expertise that, much like access to these kits, that expertise is also sold on an as-a-service basis," Diallo said.

Further, he has observed the real-time session orchestration features of earlier kits being copied into new phishing kits designed exclusively to augment the needs of callers.

Where threat actors could once pay for access to a kit with basic features that targeted all popular Identity Providers (Google, Microsoft Entra, Okta etc) and cryptocurrency platforms, a new generation of fraudsters are attempting to sell access to bespoke panels for each targeted service.

Recommendations

Thankfully there is absolutely no doubt about what defenders need to do.

"In a workplace context, there is no substitute for enforcing phishing resistance for access to resources," said Diallo.

When using Okta for workforce authentication, that would equate to enrolling users in Okta FastPass, passkeys or "both for the sake of redundancy," he said.

Social engineering actors can also be frustrated by setting network zones or tenant access control lists that deny access via the anonymizing services favoured by threat actors.

"The key is to know where your legitimate requests come from, and allowlist those networks," Diallo said.

Some banks and cryptocurrency exchanges are also experimenting with live caller checks - in which a user can sign into a mobile app to find out whether they are on a phone call with an authorized representative at the time.

Okta Threat Intelligence has published threat advisories on voice-enabled phishing campaigns in April 2025 and January 2026 that are available exclusively to the security contacts of Okta customers.

These threat advisories include:

Indicators of Compromise (IoCs)
Analysis of multiple phishing kits
TTPs of intrusion actors conducting these attacks
Detailed control recommendations

To learn more about Okta's approach to phishing resistance, start here.

Jobseekers exploited in fake recruiter phishing campaigns

Daniel L�pez — Fri, 19 Dec 2025 08:00:00 +0000

Resumen Ejecutivo

Okta Threat Intelligence ha identificado multiples grupos de actividad de phishing de gran volumen que se hacen pasar por equipos de reclutamiento de varias empresas, utilizando mas de 400 dominios para facilitar el robo de credenciales.

Realizamos un seguimiento de esta actividad como O-UNC-038.

En este informe detallamos:

Una campana que utiliza una tecnica de "Navegador en el Navegador" (BitB) para imitar un inicio de sesion social de Facebook, utilizando bots de Telegram para la exfiltracion de credenciales.
Una campana dirigida especificamente a las credenciales de cuentas corporativas de Google Workspace, utilizando Socket.IO para la exfiltracion de credenciales
Campanas de phishing similares con tematica de reclutamiento

El objetivo principal en todas estas campanas es la recopilacion de credenciales.

Si bien las campanas mas sofisticadas pueden aprovechar las tecnicas de Adversario en el Medio (AitM) que capturan las cookies de sesion para eludir la Multi-Factor Authentication (MFA), las campanas en este aviso realizan una simple recopilacion de credenciales a traves de kits de phishing estaticos.

Analisis de amenazas

Multiples campanas, orientacion similar

Descubrimos y rastreamos varias campanas que utilizan senuelos de phishing similares con tematica de reclutamiento y abusan de los mismos servicios para la entrega o el seguimiento de los senuelos.

En las paginas de phishing asociadas con los grupos de actividad descritos a continuacion, observamos enlaces de seguimiento vinculados con Salesforce ExactTarget:

cl.s12[.]exct[.]net/?qs=<UniqueIdentifierString>

Los actores de phishing suelen abusar de las plataformas de marketing por correo electronico para enviar correos electronicos de phishing, ya sea configurando cuentas de prueba para organizaciones falsas o tomando el control de las cuentas de los clientes de la plataforma de marketing por correo electronico. Los actores de phishing pueden entonces enviar a grandes listas de correo electronico desde una infraestructura de correo de confianza.

Okta proporciono estos dominios y enlaces de seguimiento a Salesforce Threat Intelligence, quienes pudieron suspender inmediatamente las cuentas de Salesforce asociadas e investigar las campanas.

A continuacion, detallamos los diferentes senuelos y la funcionalidad de dos de las campanas.

Analisis de amenazas - campana 1

Campana de credenciales de Facebook de tipo navegador in the navegador (BitB) ("Campana 1")

Este primer grupo que analizaremos utiliza una tecnica de Navegador en el Navegador (BitB) para adquirir las credenciales de Facebook de la victima mostrando una ventana de dialogo de inicio de sesion falsa.

Un ataque BitB es una tecnica avanzada de phishing en la que una pagina web maliciosa utiliza HTML, CSS y JavaScript para crear una ventana de navegador falsa dentro de la ventana real del navegador. Esta ventana falsa esta disenada para imitar una ventana emergente legitima, como el mensaje de "inicio de sesion con Facebook", con una barra de direcciones y un candado de seguridad falsos. Cualquier credencial introducida en esta ventana falsa es capturada por el atacante.

Rastreamos 143 dominios asociados con esta campana especifica de tecnica de Facebook/BitB. Tambien observamos cierta diversidad en el alojamiento, lo que posiblemente sugiere actores separados o subcampanas que utilizan la misma tecnica.

Esta campana utiliza mas comunmente el servicio en la nube front-end de Vercel, o registra nombres de dominio en registrar.eu y aloja los sitios con Amazon Web Services. Esta campana tambien utiliza un bot de Telegram para la exfiltracion de credenciales y para distribuir actualizaciones a los sitios.

Ejemplo: Reclutamiento falso de Meta

El ejemplo de *phishing* de credenciales suplanta la contratacion de Meta en tres paginas distintas: una pagina de destino inicial, un portal de pagina de solicitud de empleo y una pagina de inicio de sesion falsa de Facebook.

Ejemplo: Reclutamiento falso de Puma

La secuencia de las tres imagenes siguientes es otro ejemplo, esta vez simulando ser un reclutamiento de Puma:

Senuelos de phishing observados - Campana 1

La campana BitB utiliza software y servicios corporativos convincentes para enganar a los usuarios para que ingresen sus credenciales. Una vez que las credenciales del usuario se ingresan en el sitio controlado por el atacante, la pagina de envio simula un proceso suspendido.

Analisis de amenazas - campana 2

Este cluster no utiliza la tecnica BitB como se observa en la Campana 1, sino una pagina de destino estatica que imita un inicio de sesion de cuenta de Google en pantalla completa.

Las paginas de phishing utilizadas en esta campana rechazan los formatos de direcciones de correo electronico personales en un intento de capturar credenciales corporativas.

Observamos al menos 84 dominios relacionados con esta campana, que abusa de Cloudflare para ofuscar la direccion IP de origen real y de Socket.IO para la exfiltracion de credenciales robadas.

Ejemplo: Reclutamiento falso de Sony Playstation

Cualquier dato enviado en el "formulario" a continuacion se ignora, ya que esta campana solo intenta capturar credenciales de Google.

Una vez que se ingresan las credenciales, el flujo de trabajo puede terminar usando un proceso colgante similar al Cluster 1 o algun tipo de cuadro de dialogo de error.

Otros Clusteres de Phishing Tematicos de Reclutamiento

Nuestra investigacion sobre los dos grupos de phishing distintos anteriores revelo varias campanas similares con temas de reclutamiento, incluyendo casi 200 dominios de phishing adicionales.

Estos se pueden agrupar en grupos de combinaciones de infraestructura y/o tecnicas de nombres, lo que puede sugerir que varios actores independientes pueden estar detras de estas campanas de temas similares.

Estas campanas e infraestructura suplantan a multiples empresas conocidas y servicios de reclutamiento, incluidas:

Adecco
Adidas
Aquent
Calendly
Calvin Klein
Cisco
CocaCola
Genpact
Givenchy
Google
Hays
Ikea
Inditex
Meta
Playstation (Sony)
Puma
Randstand
Robert Half
Robert Walters
Salesforce
Starbucks
YouTube
Zara

Muchos de estos dominios de campana no utilizan un host predeterminado / "www", sino nombres de host especificos como:

apply.
contratar.
careers.
calendly.
caso.
hr.
empleos.
Unase.
kvn.
reclutar.
recruite.
programar.
personal.
Inicio.
hilos.
xds.

Esto puede reforzar una URL de aspecto valido para la victima y, al mismo tiempo, ofuscar las paginas de phishing en el dominio para los rastreadores o investigadores que solo examinan la raiz del dominio.

respuesta ante amenazas

Lo que estamos haciendo

Participamos activamente en las siguientes actividades para mitigar esta amenaza:

Supervision continua de dominios de phishing recien registrados e infraestructura asociada con esta campana.
Proporcionar orientacion y asistencia a las organizaciones para mejorar la seguridad de sus entornos Okta e investigar cualquier actividad sospechosa relacionada con cuentas potencialmente comprometidas.

Controles de proteccion

Recomendaciones

Habilite MFA resistente al *phishing* (FastPass/WebAuthn/claves de acceso); deshabilite SMS/voz para estos usuarios.
Bloquea y supervisa los dominios recien registrados que imitan tu servicio. Si el contenido alojado en el dominio viola los derechos de autor o las marcas legales, considera proporcionar evidencia y emitir una solicitud de eliminacion al registrador de dominio y/o al proveedor de alojamiento web.
Aplique DMARC/DKIM/SPF y alerte sobre el correo electronico de suplantacion de identidad de contratacion/reclutador.
Ensenar a los usuarios a realizar un inicio de sesion solo en dominios conocidos (escribir o usar un marcador).
Ensenar a los usuarios a detectar la suplantacion de identidad de BitB:
- Si un usuario intenta mover una ventana de inicio de sesion fuera de la ventana del sitio host principal, deberia poder moverse a cualquier lugar de la pantalla del usuario. Un dialogo de inicio de sesion falso es un elemento fijo dentro de la pagina del host principal: solo podra moverse dentro de los limites de la ventana de la pagina del host.
- Si un usuario minimiza la ventana de la pagina host, un dialogo de inicio de sesion real permaneceria mostrado independientemente de la ventana de la pagina host. Un elemento de inicio de sesion falso se minimizara en sincronia con la ventana de la pagina host.
Aconseje a los solicitantes de empleo que utilicen los portales de empleo oficiales y que rechacen las solicitudes o los enlaces para comunicarse a traves de otras plataformas.
Buscar IoCs (por ejemplo, Llamadas a la API del bot de Telegram, t.me/, bot*getUpdates, sendMessage; patrones CSS/JS de BitB).

Manual de estrategias de respuesta

Reportar y solicitar la eliminacion del sitio malicioso
Restablezca las credenciales (contrasenas, tokens de sesion) de los usuarios afectados y notifique, donde sea necesario.
Revisar los registros de SSO de los usuarios afectados.
Evalue si debe incluir consejos sobre ataques "navegador-in-the-navegador" en su programa de concientizacion sobre seguridad.

Indicadores de Compromiso

Los contactos de seguridad de los clientes de Okta pueden iniciar sesion y descargar los Indicadores de Compromiso desde security.okta.com en el siguiente enlace:

https://security.okta.com/product/okta/jobseekers-exploited-in-fake-recruiter-phishing-campaigns

Una nota sobre el lenguaje de estimacion

Los equipos de Okta Threat Intelligence utilizan los siguientes terminos para expresar la probabilidad, tal como se describe en la Directiva 203 de la Comunidad de Inteligencia de la Oficina del Director de Inteligencia Nacional de EE.UU. - Estandares Analiticos.

Probabilidad	Casi ninguna posibilidad	Muy poco probable	Poco probable	Aproximadamente posibilidades parejas	Probable	Muy probable	Casi seguro(a)
Probabilidad	Remoto	Altamente improbable	Improbable	Aproximadamente posibilidades parejas	Probable	Altamente probable	Casi Seguro
Porcentaje	1-5%	5-20 %	20-45%	45-55%	55-80%	80-95 %	95-99%

Phishing campaigns use 'Employee Benefits' lure to intercept Microsoft and Okta logins

Houssem Eddine Bordjiba — Tue, 21 Oct 2025 07:00:00 +0000

Resumen ejecutivo

Okta Threat Intelligence ha identificado campanas de phishing de varias etapas dirigidas a organizaciones que utilizan aplicaciones de Microsoft y, donde el acceso a estas aplicaciones esta federado, Okta como proveedor de identidades (IdP).

Nuestros hallazgos, primero investigando una campana distinta que etiquetamos como O-UNC-037, posteriormente nos llevaron a varias otras campanas que usaban el mismo kit de phishing y un tema de senuelo muy similar. Sin embargo, la diversidad en la infraestructura y el estilo sugiere que, si bien estos usan el mismo kit y tema, es probable que sean campanas separadas dirigidas por otros actores de amenazas. Este informe se centra en O-UNC-037, aunque compartimos detalles de las otras campanas en el apendice al final de este informe.

La campana O-UNC-037 ha estado activa al menos desde octubre de 2025 y se dirige principalmente a Organizations de tecnologia y suministro industrial. Entrega correos electronicos de phishing utilizando un senuelo tematico de beneficios para empleados o recursos humanos (RR. HH.) para enganar a los usuarios para que ingresen sus credenciales en una pagina de inicio de sesion falsa de Microsoft.

La infraestructura de phishing utiliza tecnicas de adversario en el medio (AitM) para interceptar los flujos de autenticacion en tiempo real, capturando credenciales, codigos de autenticacion multifactor (MFA) y cualquier token de sesion establecido durante el evento de inicio de sesion. Esta capacidad puede eludir la proteccion de varios metodos comunes de MFA, como los codigos SMS y las contrasenas de un solo uso (OTP) de las aplicaciones de autenticador.

Para las Organizations que usan Okta para el Single Sign-On (SSO), el ataque luego escala a una segunda etapa, redirigiendo a las victimas a una reproduccion maliciosa de una pagina de inicio de sesion de Okta en el dominio de phishing de la segunda etapa, que actua como un servidor de retransmision para capturar adicionalmente sus credenciales de Okta y robar la cookie de sesion.

Analisis de amenazas

Esta campana de phishing utiliza una tecnica de ataque de varias etapas. Se dirige especificamente a las cuentas de Microsoft y gestiona el redireccionamiento de Okta SSO cuando se encuentra. La cadena de ataque involucra varios pasos disenados para dirigir a los usuarios objetivo a una pagina de recoleccion de credenciales AitM.

Tacticas, Tecnicas y Procedimientos (TTP) observados:

Infraestructura y acceso inicial:
- Los correos electronicos de phishing se entregan con lineas de asunto personalizadas para incluir el nombre del usuario y senuelos como "Alerta de beneficios para empleados" o "mensaje seguro del Departamento de Recursos Humanos" para crear una sensacion de urgencia.
- Las campanas utilizan dominios de redireccionamiento para canalizar a los usuarios especificos hacia los sitios de phishing primarios, al tiempo que evitan los controles de la puerta de enlace de correo electronico.
- Las campanas requieren que los usuarios resuelvan un Cloudflare CAPTCHA antes de presentar la pagina de *phishing*.
Ejecucion y robo de credenciales:
- Utiliza tecnicas de Adversario-en-el-Medio (AiTM) capturando credenciales, codigos de MFA y tokens de sesion interceptando flujos de autenticacion.
- Implementa un ataque de phishing de multiples etapas, primero dirigido a las credenciales de Microsoft y luego girando a Okta SSO si se detecta la federacion.
Kit de phishing y senuelo:
- Muy probablemente aprovecha una plataforma dePhishing-as-a-Service (PhaaS), o un kit de phishing altamente configurable, evidenciado por los parametros de la URL para el seguimiento de la campana y la carga de la plantilla.
- Utiliza un senuelo de ingenieria social generico pero efectivo de "Beneficios para empleados".

Cebos de correo electronico

El ataque comienza con un correo electronico de *phishing* enviado al objetivo. Basado en sus caracteristicas visuales, es probable que estos senuelos de correo electronico altamente convincentes se generen utilizando un Modelo de Lenguaje Grande (LLM). Los correos electronicos utilizan nombres de remitentes y asuntos disenados para crear una sensacion de urgencia y legitimidad relacionada con los beneficios de los empleados o las comunicaciones seguras.

Ejemplos de encabezados de correo electronico observados:

De: ADP BENEFITS <notifications[@]duobenefits[.]com>
Asunto: [User Name]! Alerta de Beneficios para Empleados - Nuevos Cambios Vigentes Ahora

De: Secure Mail <noreply[@]mailsafe365[.]com>
Asunto: [User Name]! Ha recibido un mensaje seguro del Departamento de Recursos Humanos

Tambien observamos ejemplos de lo que parece ser un abuso de la plataforma de marketing por correo electronico de terceros de una organizacion genuina, posiblemente a traves de una cuenta comprometida:

De: ADP Benefits <notifications_adp_com[@]emails[.]t??????s[.]org>
Asunto: Confidencial: [Nombre de usuario]! Su paquete de beneficios ha sido actualizado

Enlaces de redireccionamiento iniciales en correos electronicos

Primero, los usuarios son dirigidos a la infraestructura de phishing a traves de enlaces de redireccionamiento inicial dentro de los correos electronicos. La mayoria de estos son dominios de origen recien registrados, lo que evita problemas de reputacion historica para evitar las medidas de seguridad del correo electronico:

benefits-alerts[.]com
benefitsapp001[.]com
qrcodelnk[.]com
302lnk[.]com
goto365[.]link
fastlink247[.]link
link24x7[.]link
fast2url[.]link
url247[.]link

Tambien notamos un ejemplo de enlace de redireccionamiento que abusa de la cuenta legitima de una organizacion en un servicio de marketing por correo electronico de terceros para la redireccion:

t??????s[.]msg???[.]com

Un ejemplo de enlace de redireccion utiliza el sitio web comprometido de una organizacion genuina:

Marketing.s??????y[.].com

El uso de cuentas de servicios de marketing por correo electronico comprometidas o sitios web genuinos comprometidos es una medida eficaz para lograr una mayor capacidad de entrega durante las campanas de phishing.

La capa de redireccionamiento tambien le brinda al actor de amenazas la capacidad de sustituir paginas de *phishing* de reemplazo, en caso de que alguna pagina de segunda etapa sea eliminada.

Desafio de seguridad

Tras la redireccion al sitio de *phishing* principal, al usuario se le presenta primero una pagina titulada "Verificacion de seguridad", que emplea un CAPTCHA genuino de Cloudflare. Este paso esta disenado para parecer legitimo y actua como un "guardian" para evadir el analisis automatizado del sitio de *phishing*.

Pagina de presentacion

Una vez que se completa el desafio CAPTCHA, el sitio muestra brevemente una pantalla de presentacion con un tema que se adapta al senuelo mencionado anteriormente.

Recopilacion de credenciales

Despues de la pantalla de presentacion, se presenta a un usuario objetivo la pagina de phishing de primera etapa, que suplanta un inicio de sesion de Microsoft y utiliza AitM para robar las credenciales del usuario y, si el usuario se autentica correctamente, los tokens resultantes.

Redireccion de segunda etapa al inicio de sesion de Okta

Si el dominio de correo electronico de la victima indica que su organizacion utiliza Okta para la federacion de identidades, la secuencia de comandos del sitio de phishing intercepta el flujo de autenticacion legitimo. Reemplaza dinamicamente la URL de redireccionamiento legitima de Okta con una maliciosa (por ejemplo, sso[.]oktacloud[.]io), enviando al usuario a una pagina de phishing de Okta de aspecto similar para volver a usar AitM para obtener sus credenciales de SSO y robar la cookie de sesion resultante. Detallamos esta tecnica en nuestro analisis de codigo, mas adelante en este informe.

Infraestructura de campana original

Nuestro analisis de la campana O-UNC-037 identifico la siguiente infraestructura utilizada para alojar las paginas falsas maliciosas de pagina de inicio de sesion de Microsoft:

benefitsemployeeaccess[.]com
benefitsquickaccess[.]com
benefitsworkspace[.]com
benefitscentralportal[.]com
benefitsselfservice[.]com
benefitsmemberportal[.]com
benefitsgatewayportal[.]com
benefitshubportal[.]com
benefitsadminportal[.]com
benefitsaccessportal[.]com
benefitsviewportal[.]com

Los sitios de phishing utilizan varios paths de URL para promover el senuelo de "beneficios para empleados":

/benefits/inicio de sesion/
/compensation/auth/
/rewards/verify/
/employee/access/

Los usuarios federados son redirigidos a las siguientes paginas de destino de segunda etapa despues de proporcionar las credenciales primarias para su cuenta de Microsoft.

sso[.]oktacloud[.]io
sso[.]okta-access[.]com
Internal-networks[.]com

El analisis de los dominios de phishing de redireccionamiento dirigidos a Okta nos llevo a multiples instancias que utilizan Cloudflare Workers, que es una plataforma sin servidor a menudo utilizada por los actores de amenazas para alojar y servir sitios de phishing.

sso[.]okta-proxy[.]workers[.]dev
okta[.]undermine[.]workers[.]dev
oktapage[.]oktamain[.]workers[.]dev
okta[.]eventspecial[.]workers[.]dev

Infraestructura de campanas adicionales

Al pivotar desde la campana de phishing O-UNC-037, descubrimos otras campanas que utilizaban el mismo kit de phishing y senuelos muy similares. Las observaciones de los detalles de la infraestructura en estos otros ejemplos sugieren que es probable que estos sean operados independientemente por otros actores de amenazas, posiblemente siguiendo las instrucciones de un "metodo" compartido o vendido. Incluimos una lista de estos dominios junto con los dominios O-UNC-037 en los Indicadores de Compromiso enlazados al final de este documento.

Analisis de la pagina de phishing

Esta campana sigue una cadena de ataque estructurada que combina ingenieria social y tecnicas de AitM capaces de robar tokens de sesion tanto de Microsoft 365 como de Okta. El analisis de las URL y paginas de phishing sugiere que el actor esta utilizando un Phishing-as-a-Service (PhaaS) o un kit de phishing altamente configurable.

Un analisis detallado de las URL de phishing revela un mecanismo de control de acceso insertado dentro de sus parametros de consulta, particularmente en el parametro "ht", que contiene un objeto JSON codificado en Base64.

https://benefitsemployeeaccess[.]com/rewards/verify/d582500e?s=3&ht=eyJpZCI6IjY2ZmI2OWMwNjA2N2RjOTM5Yzc5OTM1NWE0ODNjNzM3IiwidHlwZSI6ImhvcCIsImNhbXBhaWduX2lkIjoiY2FtcF82OGYyNjQ3YTlmYjE0IiwiaG9wX3RlbXBsYXRlIjoiYmVuZWZpdHMiLCJzdWNjZXNzX3RlbXBsYXRlIjoiYmVuZWZpdHNfZXJyb3IiLCJjcmVhdGVkIjoxNzYwOTM3NDcyLCJleHBpcmVzIjoxNzYwOTQ0NjcyLCJpcCI6IjExMy4yOS4yNDMuMSIsIm1heF91c2VzIjoxMDAwMDAwMCwidXNlcyI6MCwiaG9wX2NvdW50IjozLCJzZXNzaW9uIjoiZG9oNnBhbnE0Y3RhZTVsMjhvNWoyaTdoa3YifQ%3D%3D.bb0c9db57db67ff678edafb64f3cdc4fccfa93d4a8952e05ca2a3176e8134db5

Cuando se decodifica, este objeto revela un conjunto completo de puntos de datos tanto para el seguimiento como para el control de acceso. Contiene informacion de seguimiento detallada, incluyendo un "campaign_id", una "hop_template" para la carga dinamica de contenido, la direccion "ip" de la victima y un ID de "sesion" unico. Simultaneamente, incluye los terminos de acceso a traves de la creacion de enlaces y las marcas de tiempo de caducidad ("created", "expires") y los contadores de uso ("uses", "max_uses"). Esta estructura de doble proposito indica un sistema de backend que no solo funciona como un guardian para hacer cumplir el acceso estricto y de tiempo limitado, sino que tambien permite al actor dar seguimiento a campanas individuales, cargar dinamicamente diferentes plantillas de phishing y supervisar las interacciones de las victimas. Esta capacidad permite al actor adaptar facilmente sus senuelos y objetivos sin volver a desplegar toda la infraestructura.

  "id": "66fb69c06067dc939c799355a483c737",

  "type": "hop",

  "campaign_id": "camp_68f2647a9fb14",

  "hop_template": "benefits",

  "success_template": "benefits_error",

    "created": 1760973582,

  "expires": 1760980782,

  "ip": "?????",

  "max_uses": 10000000,

  "uses": 0,

    "hop_count": 3,

  "session": "qa061c1uiht26gmtqcj49fsgci"

El analisis de la pagina inicial de phishing de Microsoft muestra el manejo de usuarios de organizaciones federadas con Okta. Cuando un usuario de este tipo ingresa su correo electronico, un portal de inicio de sesion legitimo de O365 normalmente devolveria una respuesta JSON que contiene una FederationRedirectUrl que apunta al inquilino de Okta de la empresa.

La campana utiliza JavaScript en la pagina de phishing para interceptar este proceso. La secuencia de comandos esta configurada para:

Supervisar las respuestas de busqueda del servidor.
Inspeccione las respuestas JSON en busca de claves como FederationRedirectUrl, AuthURL o RedirectUrl.
Compruebe si la URL apunta a un inquilino legitimo de Okta (.okta.com, .oktapreview.com, etc.).
Si se encuentra una URL legitima de Okta, la secuencia de comandos la reemplaza dinamicamente con una URL que apunta al dominio de phishing malicioso de segunda etapa del actor, por ejemplo: sso[.]oktacloud[.]io.
Luego, la respuesta modificada se devuelve al navegador, redirigiendo sin problemas al usuario a la pagina de inicio de sesion falsa de Okta del actor.
Las credenciales capturadas y las cookies de sesion se filtran a un extremo de API "/api" en el servidor de phishing.
La secuencia de comandos incluye funciones para autocompletar el nombre de usuario del hash de la URL y hacer clic automaticamente en los botones "Siguiente" y "Mantener la sesion iniciada", creando una experiencia mas fluida y menos sospechosa para la victima.

Esta intercepcion de AitM permite al actor secuestrar el flujo de autenticacion en tiempo real, presentando al usuario una replica de la pagina de inicio de sesion de Okta para capturar las credenciales de SSO y la cookie de sesion establecida.

     var _wd = "https://sso.oktacloud.io";

        var _iO = function (u) {

            if (typeof u !== "string") return false;

                        if (u.includes("sso.oktacloud.io")) return false;

            si (u.includes("/app/office365")) return true;

            if (u.match(/\.(okta|oktapreview|okta-emea)\.com/i)) return true;

            if (u.match(/\/sso\/saml|\/sso\/wsfed|\/aplicacion\/[^\/]+\/sso/i)) return true;

            return false;

};

Intentos posteriores de apropiacion de cuentas

Tras el compromiso exitoso de las credenciales y el robo del token de sesion, se ha observado que los actores de amenazas intentan autenticarse, y lo logran, desde las IP de CloudFlare (AS13335).

respuesta ante amenazas

Lo que estamos haciendo

Estamos activamente involucrados en las siguientes actividades para mitigar esta amenaza:

Supervision continua de dominios de phishing recien registrados e infraestructura asociada con esta campana.
Presentar proactivamente informes de abuso a los registradores y proveedores de alojamiento relevantes para iniciar solicitudes de eliminacion de los sitios maliciosos identificados.
Proporcionar orientacion y asistencia a las organizaciones para mejorar la seguridad de sus entornos Okta e investigar cualquier actividad sospechosa relacionada con cuentas potencialmente comprometidas.

Controles de proteccion

Recomendaciones para los clientes

Inscriba a los usuarios en autenticadores solidos como Okta FastPass, FIDO2 WebAuthn y tarjetas inteligentes, y aplique medidas de resistencia al phishing en las politicas.
Las politicas de inicio de sesion de la aplicacion Okta (anteriormente "politicas de autenticacion") tambien se pueden utilizar para restringir el acceso a las cuentas de usuario en funcion de una variedad de requisitos previos configurables por el cliente. Recomendamos a los administradores que restrinjan el acceso a las aplicaciones confidenciales a los dispositivos que son administrados por las herramientas de administracion de extremos y protegidos por las herramientas de seguridad de extremos. Para el acceso a aplicaciones menos confidenciales, requiera dispositivos registrados (usando Okta FastPass) que exhiban indicadores de higiene esencial.
Denegar o requerir mayor seguridad para las solicitudes de redes poco utilizadas. Con Okta Network Zones, el acceso puede ser controlado por ubicacion, ASN (Numero de Sistema Autonomo), IP y Tipo de IP (que puede identificar proxies de anonimizacion conocidos).
Las evaluaciones de Comportamiento y Riesgo de Okta pueden utilizarse para identificar solicitudes de acceso a aplicaciones que se desvian de los patrones de actividad del usuario establecidos previamente. Se pueden configurar politicas para actualizacion a nivel superior o denegar las solicitudes utilizando este contexto.
Capacite a los usuarios para que identifiquen indicadores de correos electronicos sospechosos, sitios de phishing y tecnicas comunes de ingenieria social utilizadas por los atacantes. Facilite a los usuarios la notificacion de posibles problemas configurando Notificaciones al Usuario Final y Reporte de Actividad Sospechosa.
Documente, divulgue y respete un proceso estandarizado para validar la identidad de los usuarios remotos que se ponen en contacto con el personal de soporte de TI, y viceversa.
Adopta un enfoque de "Cero privilegios permanentes" para el acceso administrativo. Asigna a los administradores Roles de Administrador Personalizados con los permisos minimos necesarios para las tareas diarias, y requiere la autorizacion dual para el acceso JIT (justo a tiempo) a roles mas privilegiados.
Aplicar IP Session Binding a todas las aplicaciones administrativas para evitar la repeticion de sesiones administrativas robadas.
Habilite Protected Actions para forzar la reautenticacion cada vez que un usuario administrativo intente realizar acciones confidenciales.

Observacion y respuesta a la infraestructura de phishing:

Revise los registros de aplicaciones (registros de Okta, proxies web, sistemas de correo electronico, servidores DNS, firewalls) para cualquier evidencia de comunicacion con dichos dominios sospechosos.
Supervise los dominios regularmente para verificar si el contenido cambia.

Si el contenido alojado en el dominio infringe los derechos de autor o las marcas legales, considere proporcionar evidencia y emitir una solicitud de eliminacion con el registrador del dominio y/o el proveedor de alojamiento web.

Indicadores de compromiso

Los contactos de seguridad de los clientes de Okta pueden iniciar sesion y descargar los Indicadores de Compromiso como un archivo CSV desde security.okta.com en el siguiente enlace:

https://security.okta.com/product/okta/phishing-campaigns-use-employee-benefits-lure-to-intercept-microsoft-and-okta-logins

Una nota sobre el lenguaje de estimacion

Probabilidad	Casi ninguna posibilidad	Muy improbable	Poco probable	Aproximadamente posibilidades parejas	Probable	Muy probable	Casi cierto(mente)
Probabilidad	Remoto	Altamente improbable	Improbable	Aproximadamente posibilidades parejas	Probable	Altamente probable	Casi Seguro
Porcentaje	1-5%	5-20%	20-45%	45-55%	55-80 %	80-95 %	95-99%

Wide-scale, opportunistic SMS pumping attacks target customer sign-up pages

Grayson Schermerhorn, Mathew Woodyard — Tue, 14 Oct 2025 07:00:00 +0000

Executive Summary

Okta Threat Intelligence has identified a cluster of shared disposable email infrastructure and commodity proxy services, internally designated as O-UNC-036, that is being used to launch high-volume, automated attempts against public API endpoints.

This infrastructure has been observed in multiple persistent, large scale and financially motivated SMS pumping campaigns starting at least as early as July 2025.

To execute this attack, threat actors undertake the following sequence of actions:

Create a new account using a disposable email address, often tied to a set of domains
Add an actor-controlled phone number as an authentication factor
Send as many messages to the number as possible in order to achieve their monetary objectives

These attacks generate significant financial costs for the target organizations by running up bills with their telephony providers. We have been able to track historical activity from this cluster of disposable email domains back to at least March 2024, indicating a sustained, adaptive effort. Due to the high financial risk and potential for service degradation, we strongly recommend the immediate implementation of the protective controls, monitoring and aggressive response outlined in this report.

Threat Analysis

The primary objective of this campaign is opportunistic, large-scale account creation in order to carry out SMS pumping campaigns. In these attacks, threat actors profit by collaborating with high-cost international or premium-rate SMS providers. By exploiting the SMS delivery system of the target identity platform, the attacker triggers messages to phone numbers they control in high-cost regions. The victim organization is then billed for the exorbitant volume and cost of these international or premium SMS messages, with the cost of attacks potentially costing hundreds of thousands of dollars in telephony bills.

The attack follows a high-volume pattern:

Reconnaissance and Enumeration: Attackers identify multi-factor authentication (MFA) or user registration endpoints that trigger an SMS code.
Infrastructure Setup: Actors use commodity proxy services (VPNs, anonymizing proxies, residential botnets etc.) to distribute the source IP addresses of the traffic, reducing the efficacy of rate-limiting based solely on IP.
High-Volume Requests: Automated scripts submit requests using known, high-cost phone country codes and rapidly generated, disposable email addresses.
Cluster Activity: The O-UNC-036 infrastructure is a key enabler. This cluster utilizes a revolving pool of shared disposable email domains to bypass email-based rate limits and tenant-level velocity checks, allowing them to rapidly cycle through accounts for message requests. Okta Threat Intelligence has tracked activity in this cluster back to at least March 2024.
Target Scope: We observed this activity in multiple tenants and organizations of both Auth0 and OCI, indicating a widespread, indiscriminate search for vulnerable endpoints that trigger SMS delivery. The same shared infrastructure is likely also used to attack organizations building their own customer sign-in pages or using alternative services.

For technical details of how to identify these attacks in your logs, see the Detection and Indicators sections of this report.

Detection

Our research has not uncovered any legitimate use of emails under domains listed in the indicators section of this report. Thus the existence of users with such emails is sufficient to detect attacks. Given the potential duration of this attack, it is critical that administrators look back as far as possible in their logs to determine the scope of past and future impact.

Okta Customer Identity

High numbers of messages being sent to countries outside of your company's normal operating regions.
A spike in the following event types:

        system.sms.send_okta_push_verify_message

        system.sms.send_factor_verify_message where result=DENY

and

        reason=Toll Fraud Suspected

A spike in the following event type:

        system.email.new_device_notification.sent_message

as malicious account's alternative proxy providers or ASNs every login.

See the "Monitoring of your Okta org" section of our support article "How to Mitigate Toll Fraud when Using Okta for Voice Authentication" for a comprehensive overview of detection strategies.

Auth0

ss events from the domains listed in the Indicators of Compromise section. Administrators should refer to detection rules provided in the FOSS Auth0 Security Detection Catalog and modify them as needed.
Spikes in Guardian events, especially gd_enrollment_complete and gd_send_sms events. We advise administrators to use the risk_of_signup_fraud_by_volume.yml and sms_bombarding.yml detection rules in the Auth0 Security Detection Catalog.
A spike in "MFA bypass" events in Security Center.
High numbers of messages being sent to countries outside of your company's normal operating regions.

Protective controls and response

Okta Threat Intelligence has observed these attackers abandon a target when frustrated by the introduction of controls. This makes aggressive response and implementation of proper controls effective in stopping these attacks.

While ever sending SMS messages costs money, attackers will find a way to skim off the top. This risk can only be fully mitigated by migrating to another authentication factor. We strongly recommend the adoption of FIDO Authentication (passkeys).
Our research has not uncovered legitimate use of the domains provided in the Identicators section of this document. Deactivate users that provided these emails after making your own assessment.
Accounts created from the ASNs in the Indicators section of this document are seldom legitimate. Administrators are advised to deactivate these accounts unless friction is a major concern.
Disable sending messages to untrusted countries in your telephony provider.

Okta Customer Identity

Implement FIDO Authentication with WebAuthn and migrate users' factors away from SMS.
Use passkeys instead of SMS or voice factors.
Enable bot protection for enforcement. We recommend setting a Bot Likeliness threshold of Low and above or Always on Sign-up and Sign-in flows when you are under attack.
Block anonymizers and proxies at edge by leveraging enhanced dynamic network zones.
Utilizing workflows to manage self-service registration users from malicious domains. An Okta Identity Defense generated workflow exists that can be utilized or expanded upon and can be found here.
Utilize the Okta API to quickly deactivate large batches of identified users.
Leverage identity proofing integrations.
See our support article "How to Mitigate Toll Fraud when Using Okta for Voice Authentication" for a comprehensive overview of responses and preventative controls.
Block suspicious activity using the tooling provided by your telephony provider.

Contact Okta Support to provide a list of allowed telephony countries if you're confident in the specific list of countries servicing your customers. You can also request to modify the rate limits on your organization.

Auth0

Implement FIDO Authentication with Webauthn and migrate users' factors away from SMS or voice factors.
Use passkeys instead of SMS or voice factors.
Block requests from the ASes and TLS client fingerprints in the Indicators of Compromise section at edge with Auth0's Tenant Access Control List feature.
Since these attackers are especially sensitive to friction, enabling bot detection and enforcing CAPTCHA can be an effective control.
Block users from registering using the email domains listed in the
Indicators of Compromise section with Signup and Login triggers.
Disable sending messages to untrusted countries in your telephony provider.
Lower your rate limits to lower the number of accounts attackers can create using the same IP address.
Consider identity proofing integrations like those available in the Auth0 marketplace.
If you identify a large number of fraudulent users, engage Auth0 support for assistance.

Grayson Schermerhorn and Mathew Woodyard contributed to this research.

Appendix A: Indicators

This is an ongoing investigation, and additional Indicators may be identified as the campaign evolves. Organizations are advised to remain vigilant and implement the recommended mitigation strategies.

Domain
2mails1box.com 300bucks.net blueink.top desumail.com e-boss.xyz e-mail.lol echat.rest electroletter.space emailclub.net energymail.org gogomail.ink gopostal.top guesswho.click homingpigeon.org kakdela.net letters.monster lostspaceship.net	message.rest myhyperspace.org mypost.lol postalbro.com protonbox.pro rocketpost.org sendme.digital shroudedhills.com specialmail.online ultramail.pro whyusoserious.org wirelicker.com writeme.live writemeplz.net

Domain

2mails1box.com
300bucks.net
blueink.top
desumail.com
e-boss.xyz
e-mail.lol
echat.rest
electroletter.space
emailclub.net
energymail.org
gogomail.ink
gopostal.top
guesswho.click
homingpigeon.org
kakdela.net
letters.monster
lostspaceship.net

message.rest
myhyperspace.org
mypost.lol
postalbro.com
protonbox.pro
rocketpost.org
sendme.digital
shroudedhills.com
specialmail.online
ultramail.pro
whyusoserious.org
wirelicker.com
writeme.live
writemeplz.net

Autonomous Systems Number (ASN)
212238 16276 44477 26548 200373 137409 214483 13213 397368

TLS Client JA4 Fingerprints are also available from an unredacted advisory that Okta customers can download at security.okta.com.

The s1ngularity attack: When attackers prompt your AI agents to do their bidding

Brett Winterford — Sun, 05 Oct 2025 22:00:00 +0000

A mediados de septiembre, un incidente en la cadena de suministro de software, comunmente denominado "ataque s1ngularity", marco un punto de inflexion en el uso de la Inteligencia Artificial por parte de los adversarios.

Si bien el vector de acceso inicial era familiar (un ataque de phishing dirigido a los mantenedores de paquetes npm), el malware resultante era novedoso. Este es uno de los primeros ataques en los que los agentes locales de IA se utilizaron como arma para ayudar en el robo de credenciales.

Esta tecnica representa una escalada amenazante en el ingenio de los atacantes, que va mas alla de simples secuencias de comandos personalizadas para aprovechar las capacidades de resolucion de problemas de las herramientas de IA ya disponibles en la maquina de un objetivo.

Me sente con Paul McCarty, Jefe de Investigacion de Safety Cybersecurity, quien recientemente publico un analisis detallado del ataque, para discutir sus hallazgos, incluyendo los *prompts* de IA utilizados para buscar secretos y evitar las medidas de seguridad, y como esta amenaza podria evolucionar en el futuro. Mira el video de arriba o sigue leyendo para obtener una descripcion general de lo que hablamos.

La anatomia de un ataque posterior a la instalacion

Durante el ataque, se enviaron actualizaciones maliciosas a paquetes npm populares, incluyendo nx, lo que finalmente resulto en el robo de miles de Developers credenciales. Un componente clave del malware fue una secuencia de comandos posterior a la instalacion que el atacante nombro telemetry.js.

La funcion principal de esta secuencia de comandos era ejecutarse inmediatamente despues de la instalacion y buscar archivos confidenciales y secretos en el host comprometido. Fundamentalmente, el atacante introdujo un nuevo metodo de deteccion, verificando la presencia de agentes CLI locales para modelos de lenguaje grande (LLM) populares, especificamente Claude, Gemini y AWS Q.

McCarty describe esto como una clara evolucion del enfoque de "vivir de la tierra", donde los atacantes abusan de herramientas preinstaladas y de confianza. Los desarrolladores a menudo tienen estos agentes de la Interfaz de Linea de Comandos (CLI) instalados para optimizar los flujos de trabajo de codificacion, lo que los convierte en un objetivo de alto valor y facilmente disponible para un atacante.

Aprovechandose de los avisos locales

La secuencia de comandos maliciosa telemetry.js no solo buscaba archivos de forma pasiva; usaba agentes de IA para hacer el trabajo pesado a traves de un prompt.

Verificacion inicial: La secuencia de comandos detectaria si un agente de IA compatible (aplicacion CLI) estaba instalado y en que plataforma (el malware se dirigia principalmente a hosts Linux y macOS).
El prompt: El malware luego ejecuto un prompt especialmente disenado a traves del agente instalado. El objetivo principal del prompt era la enumeracion de archivos: pedirle a la IA que buscara recursivamente en el sistema de archivos del host y generara una matriz completa de archivos que podrian contener secretos.
Secretos especificos: Esto no fue una busqueda a ciegas. El *prompt* se centro en "archivos jugosos", como .env y .config archivos, que comunmente contendrian secretos, como:
- Tokens de GitHub y npm
- Credenciales de la plataforma en la nube (por ejemplo, tokens de AWS)
- Claves SSH

El papel del agente de IA era utilizar los vastos datos de capacitacion del LLM y la conciencia contextual del entorno del objetivo para determinar las mejores ubicaciones para buscar. El agente de IA proporciono eficazmente al atacante una herramienta de deteccion que podia adaptarse dinamicamente al entorno objetivo.

Los agentes de IA son impredecibles, pero lo suficientemente confiables a escala

El analisis de la carga util del ataque de McCarty revelo una vision fascinante del proceso de pensamiento del atacante. Multiples actualizaciones sucesivas de los paquetes envenenados revelan al menos cuatro versiones diferentes del *prompt* de IA.

Esta rapida iteracion fue una batalla activa contra el no determinismo y las medidas de seguridad inherentes a las aplicaciones de IA. El atacante tuvo que experimentar continuamente para encontrar el *prompt* perfecto que:

Eludir medidas de proteccion: Evite las protecciones integradas del agente que rechazan solicitudes maliciosas evidentes o solicitudes para acceder a recursos del sistema de archivos.
Maximice los resultados: Genere la lista mas completa de rutas de archivos confidenciales
Optimizar la velocidad: Limite el enfoque para excluir los archivos de codigo fuente comunes, acelerando el proceso general de recopilacion de datos

Este proceso iterativo demuestra una de las deficiencias de las herramientas de IA: los usuarios a menudo tienen que hacer la misma pregunta varias veces, de diferentes maneras, para acercarse a un resultado exitoso. Tambien destaca un riesgo creciente para los defensores: no hay garantias de que los agentes de IA se adhieran a las barreras de proteccion. Como demostro la propia prueba de McCarty, los agentes de IA a veces "ignoraron las barreras de proteccion y simplemente entraron en modo YOLO".

Este incidente confirma que la IA agentic representa una nueva superficie de ataque importante. Cuando se conectan a estaciones de trabajo de Developer, pueden ser utilizados como un potente motor de deteccion para la recopilacion de credenciales y otra informacion confidencial.

Lectura recomendada

Para un desglose tecnico y profundo de las cuatro versiones de prompts maliciosos de IA y sus diferentes tasas de exito contra Claude y Gemini, recomendamos encarecidamente leer el analisis completo de Paul McCarty y el equipo de Seguridad: Analysing the AI used in the NX Attack.

EvilProxy phishing campaign leverages convincing impersonations of enterprise applications

Daniel L�pez — Tue, 30 Sep 2025 07:00:00 +0000

Resumen ejecutivo

Okta Threat Intelligence ha identificado una campana de ataque de alto volumen que, segun investigaciones posteriores, ha estado activa desde al menos marzo de 2025, aprovechando el kit de herramientas de phishing como servicio (PhaaS) EvilProxy para ejecutar ataques de phishing en tiempo real disenados para robar credenciales de usuario y cookies de sesion activas. Realizamos un seguimiento de esta campana como O-UNC-035.

Esta operacion tiene como objetivo organizaciones de numerosos sectores, incluidos las finanzas, el gobierno, la salud y la tecnologia, utilizando principalmente senuelos muy convincentes que se hacen pasar por herramientas empresariales populares como SAP Concur y servicios de firma de documentos como Adobe o DocuSign.

Analisis de amenazas

EvilProxy Phishing como servicio

EvilProxy (O-TA-041) es un kit de herramientas PhaaS que utiliza una arquitectura de proxy inverso/adversario en el medio (AitM) para interceptar los inicios de sesion y las cookies de sesion de las victimas en tiempo real, lo que permite a los atacantes evitar la autenticacion multifactor (MFA) y secuestrar cuentas.

Observado originalmente en 2022 y rapidamente convertido en producto en las tiendas de la dark web, EvilProxy se ha utilizado ampliamente en la apropiacion de cuentas dirigidas y en las campanas de compromiso de correo electronico empresarial porque sirve de proxy para sitios legitimos. Esto significa que los usuarios ven mensajes reales de MFA y que el atacante puede capturar tokens y cookies para que el atacante los reproduzca. Debido a que EvilProxy se vende y se mantiene como un servicio, escala los ataques y disminuye la barrera de habilidades para los delincuentes: los operadores pueden lanzar grandes volumenes de campanas de phishing a medida.

Mecanismos de senuelo

Hemos observado la suplantacion de software y servicios de Enterprise de confianza para enganar a los usuarios para que hagan clic en enlaces e ingresen credenciales:

Servicios de firma de documentos (como Docusign, Adobe Acrobat, Adobe Sign, EchoSign): Un tema constante observado en esta campana fue la suplantacion de proveedores de gestion de documentos y firma electronica. Los atacantes utilizan la promesa de un documento compartido o una solicitud de firma para atraer a las victimas.
Plataformas de gastos y adquisiciones (como SAP Concur, Coupa): Este fue el senuelo mas frecuente observado en esta campana. Se dirige a los empleados suplantando sistemas populares de gestion de gastos y viajes, a menudo con indicaciones para aprobar un informe o revisar un gasto. Un senuelo mas generico utiliza terminos como gasto, informe de gastos o soluciones de gastos.
Microsoft SharePoint: La campana tambien se dirige a los usuarios del ecosistema de Microsoft 365 fingiendo un enlace a un documento compartido o a un sitio de colaboracion.
Reuniones en linea: Los atacantes registraron dominios genericos que incluyen palabras como reunion para hacerse pasar por invitaciones a plataformas de reuniones.
KnowBe4: Los atacantes se hicieron pasar por una empresa de capacitacion en concientizacion sobre seguridad, en un intento de enganar a los usuarios objetivo para que asumieran que el senuelo de phishing era parte de una prueba de phishing oficial.

Analisis de codigo

La cadena de redireccion del senuelo comienza con un enlace corto en el que la direccion de correo electronico de la victima esta ofuscada dentro de la ruta URL. Luego, el usuario es rebotado a traves de un redirector con la marca del nombre de la empresa objetivo en el subdominio y, finalmente, lo lleva a una pagina de phishing convincente con la marca de Microsoft que roba credenciales. El JavaScript en el redirector extrae el correo electronico de la ruta, lo vuelve a codificar y crea una URL de redireccionamiento personalizada que lleva esa identidad a traves de cada salto.

Ejemplo 1 de cadena HTTP

Enlace inicial:

hxxps[://]expensereport[.]ch/[coded_string]

Redirector:

hxxps[://][empresa][.]sapconcur[.]sa[.]com/expense/?uid=[uid]&hid=[hid]
&document=[document]&token=[token]&t=[t]

URL final (que muestra el sitio web de inicio de sesion para la recopilacion de credenciales):

hxxps[://][32_characters_string][.]laurimarierefling[.]com/?uid=[uid]&hid=[hid]
&document=[document]&token=[token]&t=[token]&[string_7_characters]=[string_32_characters]

Ejemplo de cadena HTTP 2

Enlace inicial:

hxxps[://]sapconcursolutions[.]pl/[coded_string]

Redirector:

hxxps[://][empresa][.]sapconcur[.]sa[.]com/expense/?uid=[uid]&hid=[hid]
&document=[document]&token=[token]&t=[t]

URL final (que muestra el sitio web de inicio de sesion para la recopilacion de credenciales):

hxxps[://][32_characters_string][.]concurmgt[.]pl//?uid=[uid]&hid=[hid]
&document=[document]&token=[token]&t=[token]&[string_7_characters]=[string_32_characters]

Como el redirector decodifica y personaliza a la victima

Las paginas de phishing aceptan el ultimo segmento de la ruta e intentan usar varios decodificadores en secuencia (mapeo de tokens personalizados, hexadecimal, Base32 y Base64) hasta que el resultado contenga "@". Ese valor se convierte en el correo electronico de la victima para su uso de etapa final, como se muestra en este ejemplo de codigo de pagina de senuelo inicial:

let encodedValue = window.location.pathname.split('/').pop();
...
correo electronico = decodeEmail(encodedValue); // mapa de trigramas personalizado
...
if (!decodingSuccessful && isHexadecimal(encodedValue)) correo electronico = hexToString(encodedValue);
if (!decodingSuccessful && isBase32(encodedValue)) correo electronico = base32ToString(encodedValue);
if (!decodingSuccessful && isBase64(encodedValue)) correo electronico = base64ToString(encodedValue);

El decodificador personalizado reemplaza los tokens de tres caracteres nuevamente en caracteres, utilizando un mapa como:

const encodingMap = {
    "@":"MN3",".":"OP4","a":"QR5","e":"ST6","i":"UV7",
    "o":"WX8","u":"YZ9","s":"ABO","n":"CD1","r":"EF2",
    "d":"GH3","I":"JK4"
};

Puertas de anti-analisis

Antes de redirigir, la secuencia de comandos intenta evitar rastreadores y entornos de prueba:

function isBot() {
    const botPatterns = ['bot','spider','crawl','slurp','baidu','yandex',
        'wget','curl','lighthouse','pagespeed','prerender','screaming frog',
        'semrush','ahrefs','duckduckgo'];
if (navigator.webdriver || navigator.complementos.length === 0 ||
    navigator.languages === "" || navigator.languages === undefined)
return true;
...
}

Si se encuentra una senal de bot/sin cabeza, o si aparece la organizacion "bloqueada" del operador, la pagina se redirige directamente al inicio de sesion legitimo de Microsoft, lo que brinda a los equipos de triaje una pagina limpia mientras los usuarios reales continuan con el phishing. El servicio api.ipify.org se utiliza para devolver la direccion IP publica de la victima, para compararla con una lista de bloqueo de IP/rango.

Dominios en la lista de bloqueo

El codigo tambien contiene dos dominios bloqueados, que si se encuentran en la direccion de correo electronico de la victima, haran que el flujo de phishing salga en su lugar a la pagina de inicio de sesion autentica de Microsoft:

const blockedDomains = ['belfius', 'baringa'];
const emailDomain = correo electronico.split('@')[1].toLowerCase();

for (const blocked of blockedDomains) { {
        window.location.href = "https://login.microsoftonline.com/common/login";
return;
    }
}

Se desconoce la procedencia del bloqueo de estos dos dominios. El dominio "belfius" parece referirse a un banco belga, mientras que "baringa" parece estar asociado con una consultora de gestion del Reino Unido.

Parametros de consulta

En todas las muestras observadas, el redireccionador construye la misma URL parametrizada y solo varia la familia del dominio. Dos parametros son el correo electronico de la victima en diferentes contenedores; el resto son valores unicos (nonces) y una marca de tiempo:

uid ? Base64(correo electronico)
- Se puede decodificar utilizando una recetade CyberChef
hid ? hex(Base64(correo electronico))
- Se puede decodificar utilizando una recetade CyberChef
documento, token ? identificadores aleatorios (tipo nonce)
t ? Timestamp Unix (ms)
- Se puede convertir a una fecha legible por humanos usando una recetade CyberChef

flujo de autenticacion

Dentro del flujo de autenticacion, el nombre de la empresa suplantada aparece en ciertos campos tanto del redirector como de la URL final. Ademas, el marco de phishing completa automaticamente la direccion de correo electronico de la victima en el campo de nombre de usuario de la pagina de phishing.

Enlace inicial:

hxxps[://]expensereport[.]ch/616c6578616e6465722e652e6261754073662e6672622e6f7267

Redireccionador:

hxxps[://]sf[.]sapconcur[.]sa[.]com/expense/?uid=...&hid=...&document=...&token=...&t=...

URL final

hxxps[://]299afcb76fac4238a0facad80c326230[.]concursolutions[.]asia/?uid=...&hid=...
&document=...&token=...&t=...&u9pPUdqL=...

Enlace inicial:

hxxps[://]concursecure[.]pl/AB0ST6QR5CD1OP4kUV7CD1CD1MN3cST6CD1AB0YZ9AB0OP4gWX8v

Redireccionador:

hxxps[://]census[.]concursystem[.]cv/auth/?uid=...&hid=...&document=...
&token=...&t=...

URL final

hxxps[://]6b81e59848ba4a9d8cc3b4570b303a24[.]reports[.]sa[.]com/adfs/ls/?login_hint=
...&wa=wsignin1[.]0&wtrealm=...&wctx=...

Enlace inicial:

hxxps[://]expensereport[.]ch/phUV7JK4UV7ppQR5mQR5CD1CD1UV7xMN3tfJK4OP4gWX8vOP4YZ9k

Redireccionador:

hxxps[://]tfl[.]sapconcur[.]sa[.]com/expense/uid=...&hid=...&document=...&token=...&t=...

URL final

hxxps[://]b4f1341373f341d98f11caea1052d878[.]laurimarierefling[.]com/?uid=...&hid=
...&document=...&token=...&t=...&...

Enlace inicial:

hxxps[://]concursolution[.]de/UV7JK4QR5CD1_CD1ST6tzST6EF2MN3mcQR5fST6ST6OP4cWX8m

Redireccionador:

hxxps[://]mcafee[.]concursystem[.]cv/auth/?uid=...&hid=...&document=...&token=...&t=...

URL final

hxxps[://]3b2c66787c6349369fc9f90ecf789899[.]echosign[.]uk[.]com/
app/office365/.../wsfed/passive?login_hint=...&wa=wsignin1[.]0&...

Suplantacion efectiva

Desde la perspectiva de un usuario, todo se ve como el fondo familiar de Microsoft, el favicon y una breve animacion de "por favor espere" antes de un inicio de sesion. Mientras tanto, el kit desobfusca el correo electronico de la victima, marca dinamicamente la pagina de senuelo posterior con el nombre de la organizacion objetivo y lleva identificadores (uid/hid/document/token/t) a traves de la cadena para que cualquier credencial capturada pueda vincularse a una campana especifica. El patron de URL repetible(un subdominio personalizado mas el conjunto de parametros estable), junto con el fragmento anti-bot ligero y el cargador estilo Office, proporciona deteccion y agrupacion confiables en toda esta familia.

Objetivos de la campana y modus operandi

El objetivo principal de esta campana es la recoleccion de credenciales, centrandose especificamente en la captura de credenciales de usuario y cookies de sesion activas. La actividad observada demuestra una clara intencion de eludir o capturar codigos de autenticacion multifactor (MFA), lo que indica una capacidad avanzada mas alla del simple robo de credenciales estaticas.

Sectores verticales especificos

Finanzas, Seguros y Banca: Este es el sector vertical mas atacado. Los atacantes se dirigen a los empleados de los principales bancos, empresas de inversion y companias de seguros.
Tecnologia y servicios de TI: Las principales empresas de tecnologia, software y consultoria de TI son los principales objetivos, probablemente debido a su acceso a valiosa propiedad intelectual e infraestructura critica.
Salud, productos farmaceuticos y biotecnologia: Este sector es un objetivo debido a sus datos confidenciales y su investigacion critica.
Aviacion, Viajes y Logistica: Dirigirse a este sector podria dar acceso a la logistica de viajes, informacion de reservas corporativas y datos confidenciales de los empleados.
Manufactura y Automotriz: Los gigantes mundiales de la manufactura y la automotriz tambien estan en la lista.
Venta Minorista y Bienes de Consumo: Incluye cadenas minoristas conocidas y empresas de productos de consumo.
Gobierno y Sector Publico: Varias agencias gubernamentales y organizaciones de servicio publico son el objetivo.

Pagina senuelo

La pagina raiz de los dominios utilizados en esta campana parece ser un inofensivo juego de una pagina titulado "Artistic One Page" o "Archery Master" con el fin de ofuscar el proposito de la infraestructura. Tenga en cuenta que debido a estos titulos, una consulta de busqueda que se puede utilizar para localizar infraestructura adicional en esta campana en urlscan.io, por ejemplo:

page.title:("Artistic One Page" OR "Archery Master")

Esta pagina senuelo pide a los visitantes que ingresen un nombre de usuario antes de jugar. El cliente bloquea ciertos nombres de usuario (por ejemplo: administrador, test y un filtro de blasfemias corto). Para cualquier otro nombre de usuario, el sitio lanza inmediatamente un juego de tiro con arco insertado y una experiencia de tabla de clasificacion.

respuesta ante amenazas

Lo que estamos haciendo:

Estamos activamente involucrados en las siguientes actividades para mitigar esta amenaza:

Supervision continua de dominios de phishing recien registrados e infraestructura asociada con esta campana.
Presentar de forma proactiva informes de abuso a los registradores y proveedores de alojamiento pertinentes para iniciar solicitudes de eliminacion de los sitios maliciosos identificados.
Proporcionar orientacion y asistencia a las organizaciones para mejorar la seguridad de sus entornos Okta y ayudarlas a investigar cualquier actividad sospechosa relacionada con cuentas potencialmente comprometidas.

Controles de proteccion

Recomendaciones para los clientes

Inscriba a los usuarios en autenticadores solidos como Okta FastPass, FIDO2 WebAuthn y tarjetas inteligentes, y aplique medidas de resistencia al phishing en las politicas.
Las politicas de inicio de sesion de la aplicacion Okta (anteriormente "politicas de autenticacion") tambien se pueden usar para restringir el acceso a las cuentas de usuario en funcion de una variedad de requisitos previos configurables por el cliente. Recomendamos que los administradores restrinjan el acceso a las aplicaciones confidenciales a los dispositivos que son administrados por las herramientas de Administracion de extremos y protegidos por las herramientas de seguridad de extremos. Para el acceso a aplicaciones menos confidenciales, requiera dispositivos registrados (usando Okta FastPass) que exhiban indicadores de higiene basica.
Denegar o requerir mayor seguridad para las solicitudes de redes poco utilizadas. Con Okta Network Zones, el acceso puede ser controlado por ubicacion, ASN (Numero de Sistema Autonomo), IP y Tipo de IP (que puede identificar proxies de anonimizacion conocidos).
Las evaluaciones de Okta Behavior y Risk se pueden utilizar para identificar solicitudes de acceso a aplicaciones que se desvian de los patrones de actividad del usuario establecidos previamente. Las politicas se pueden configurar para actualizar a nivel superior o denegar las solicitudes utilizando este contexto.
Capacite a los usuarios para que identifiquen indicadores de correos electronicos sospechosos, sitios de phishing y tecnicas comunes de ingenieria social utilizadas por los atacantes. Facilite a los usuarios la notificacion de posibles problemas mediante la configuracion de Notificaciones para el usuario final y elaboracion de informes de Actividad Sospechosa.
Documente, divulgue y cumplase con un proceso estandarizado para validar la identidad de los usuarios remotos que se ponen en contacto con el personal de soporte de TI, y viceversa.
Adopte un enfoque de "Privilegios Cero Permanentes" para el acceso administrativo. Asigne a los administradores Roles de administrador personalizados con los permisos minimos requeridos para las tareas diarias, y requiera autorizacion dual para el acceso JIT (justo a tiempo) a roles con mas privilegios.
Aplica el Enlace de Sesion IP a todas las aplicaciones administrativas para evitar la reproduccion de sesiones administrativas robadas.
Habilite las Acciones Protegidas para forzar la reautenticacion cada vez que un usuario administrativo intente realizar acciones confidenciales.

Observacion y respuesta a la infraestructura de phishing:

Revise los registros de aplicaciones (registros de Okta, proxies web, sistemas de correo electronico, servidores DNS, firewalls) para cualquier evidencia de comunicacion con dichos dominios sospechosos.
Supervise los dominios regularmente para ver si el contenido cambia.

Apendice A: Indicadores de compromiso

Esta es una investigacion en curso, y se pueden identificar IOCs adicionales a medida que evoluciona la campana. Se recomienda a las organizaciones que permanezcan atentas e implementen las estrategias de mitigacion recomendadas. A continuacion, se muestran los IOC observados.

Tipo	Indicador	Comentario
dominio	acrobatsign[.]es	Pagina de destino sospechosa
dominio	adobeacrobat[.]sa[.]com	Pagina de destino sospechosa
dominio	adobesign[.]ceelegal[.]com	Pagina de destino sospechosa
dominio	adobesign[.]pl	Pagina de destino sospechosa
dominio	adobesign[.]us[.]com	Pagina de destino sospechosa
dominio	asir[.]co[.]com	Pagina de destino sospechosa
dominio	blue-styles[.]cz	Pagina de destino sospechosa
dominio	ceelegal[.]com	Pagina de destino sospechosa
dominio	codemonkey[.]cc	Pagina de destino sospechosa
dominio	comcursolutions[.]de	Pagina de destino sospechosa
dominio	comcursolutions[.]eu	Pagina de destino sospechosa
dominio	comcursolutions[.]pl	Pagina de destino sospechosa
dominio	comcursolutions[.]us	Pagina de destino sospechosa
dominio	concur[.]cv	Pagina de destino sospechosa
dominio	concur[.]pages[.]dev	Pagina de destino sospechosa
dominio	concurexpense[.]pl	Pagina de destino sospechosa
dominio	concurmgt[.]pl	Pagina de destino sospechosa
dominio	concursap[.]netlify[.]app	Pagina de destino sospechosa
dominio	concursecure[.]pl	Pagina de destino sospechosa
dominio	concursolution[.]de	Pagina de destino sospechosa
dominio	concursolution[.]pl	Pagina de destino sospechosa
dominio	concursolutions[.]asia	Pagina de destino sospechosa
dominio	concursolutions[.]at	Pagina de destino sospechosa
dominio	concursolutions[.]ceelegal[.]com	Pagina de destino sospechosa
dominio	concursolutions[.]ch	Pagina de destino sospechosa
dominio	concursolutions[.]com	Pagina de destino sospechosa
dominio	concursolutions[.]com[.]tr	Pagina de destino sospechosa
dominio	concursolutions[.]cv	Pagina de destino sospechosa
dominio	concursolutions[.]cz	Pagina de destino sospechosa
dominio	concursolutions[.]de[.]com	Pagina de destino sospechosa
dominio	concursolutions[.]es	Pagina de destino sospechosa
dominio	concursolutions[.]in	Pagina de destino sospechosa
dominio	concursolutions[.]mex[.]com	Pagina de destino sospechosa
dominio	concursolutions[.]my	Pagina de destino sospechosa
dominio	concursolutions[.]nl	Pagina de destino sospechosa
dominio	concursolutions[.]pl	Pagina de destino sospechosa
dominio	concursolutions[.]pt	Pagina de destino sospechosa
dominio	concursolutions[.]re	Pagina de destino sospechosa
dominio	concursystem[.]cv	Pagina de destino sospechosa
dominio	concursystem[.]netlify[.]app	Pagina de destino sospechosa
dominio	coupahost[.]pl	Pagina de destino sospechosa
dominio	crsign[.]com	Pagina de destino sospechosa
dominio	cruisesaudi[.]sa[.]com	Pagina de destino sospechosa
dominio	dfwcom[.]com	Pagina de destino sospechosa
dominio	dnglobal[.]ca	Pagina de destino sospechosa
dominio	echosign[.]cv	Pagina de destino sospechosa
dominio	echosign[.]de[.]com	Pagina de destino sospechosa
dominio	echosign[.]eu02-safelink[.]com	Pagina de destino sospechosa
dominio	echosign[.]nl	Pagina de destino sospechosa
dominio	echosign[.]pl	Pagina de destino sospechosa
dominio	echosign[.]ru[.]com	Pagina de destino sospechosa
dominio	echosign[.]uk	Pagina de destino sospechosa
dominio	echosign[.]za[.]com	Pagina de destino sospechosa
dominio	esign[.]sa[.]com	Pagina de destino sospechosa
dominio	eu02-safelink[.]com	Pagina de destino sospechosa
dominio	eumai1-docusign[.]com	Pagina de destino sospechosa
dominio	excelpediatric[.]us[.]com	Pagina de destino sospechosa
dominio	expense[.]pl	Pagina de destino sospechosa
dominio	expense[.]sa[.]com	Pagina de destino sospechosa
dominio	expensereport[.]ch	Pagina de destino sospechosa
dominio	expensereports[.]pages[.]dev	Pagina de destino sospechosa
dominio	expensereports[.]pl	Pagina de destino sospechosa
dominio	expensereports[.]pl	Pagina de destino sospechosa
dominio	getadobesign[.]eu02-safelink[.]com	Pagina de destino sospechosa
dominio	getconcur[.]pl	Pagina de destino sospechosa
dominio	khs[.]co[.]com	Pagina de destino sospechosa
dominio	knowbe4[.]es	Pagina de destino sospechosa
dominio	meeting[.]sa[.]com	Pagina de destino sospechosa
dominio	myapps[.]sa[.]com	Pagina de destino sospechosa
dominio	na4-6l9[.]pages[.]dev	Pagina de destino sospechosa
dominio	na4[.]it[.]com	Pagina de destino sospechosa
dominio	saferedirect[.]pages[.]dev	Pagina de destino sospechosa
dominio	sapconcur[.]cv	Pagina de destino sospechosa
dominio	sapconcur[.]pages[.]dev	Pagina de destino sospechosa
dominio	sapconcur[.]sa[.]com	Pagina de destino sospechosa
dominio	sapconcursolutions[.]pl	Pagina de destino sospechosa
dominio	scality[.]us[.]com	Pagina de destino sospechosa
dominio	secure[.]za[.]com	Pagina de destino sospechosa
dominio	sharepoint[.]za[.]com	Pagina de destino sospechosa
dominio	supancasign[.]netlify[.]app	Pagina de destino sospechosa
dominio	sutheha[.]za[.]com	Pagina de destino sospechosa
dominio	team[.]sa[.]com	Pagina de destino sospechosa
dominio	ug4t5w[.]cfd	Pagina de destino sospechosa
dominio	wepp[.]website	Pagina de destino sospechosa

Una nota sobre el lenguaje de estimacion

Los equipos de Okta Threat Intelligence utilizan los siguientes terminos para expresar la probabilidad tal como se describe en la Directiva 203 de la Comunidad de Inteligencia - Estandares Analiticos de la Oficina del Director de Inteligencia Nacional de EE. UU.

Probabilidad	Casi ninguna posibilidad	Muy improbable	Poco probable	Roughly even chance	Probable	Muy probable	Casi cierto(mente)
Probabilidad	Remoto	Altamente improbable	Improbable	Aproximadamente posibilidades parejas	Probable	Altamente probable	Casi Cierto
Porcentaje	1-5%	5-20%	20-45%	45-55%	55-80 %	80-95 %	95-99%

Help desks targeted in social engineering campaign targeting HR applications

Mon, 29 Sep 2025 07:00:00 +0000

Resumen ejecutivo

Okta Threat Intelligence ha rastreado activamente un grupo de actividad con motivacion financiera conocido como O-UNC-034 desde agosto de 2025 que aprovecha la ingenieria social del personal de la mesa de ayuda para tomar el control de las cuentas y manipular los datos en los sistemas de nomina.

Se ha observado que O-UNC-034 se dirige a empleados de Organizations que operan en diferentes industrias, incluyendo, entre otras, educacion, manufactura e industriales, Venta minorista y servicios al consumidor, y productos farmaceuticos y salud. Es uno de varios grupos de actividad rastreados por Okta Threat Intelligence y otros investigadores de amenazas que se dirigen a aplicaciones de RR. HH. y nomina. Las variaciones sobre este tema incluyen el uso de *malvertising* (O-TA-54) y *phishing* AitM (STORM-2657).

El objetivo principal de O-UNC-034 es manipular los datos bancarios asociados con los usuarios objetivo en los sistemas de recursos humanos y los servicios relacionados con la nomina.

Este aviso detalla las tacticas, tecnicas y procedimientos (TTP) observados y proporciona indicadores de compromiso (IOC) relevantes asociados con esta amenaza activa.

Esta informacion se proporciona con fines informativos y de inteligencia para permitir que las organizaciones comprendan y mitiguen los riesgos que plantea esta campana.

Analisis de Amenazas

El actor de amenazas esta aprovechando tecnicas de ingenieria social al hacerse pasar por empleados legitimos.

Para el Acceso Inicial, se ha observado que el actor de amenazas inicia contacto con la mesa de ayuda de TI de la empresa objetivo, haciendose pasar por un empleado. Utilizan esta suplantacion para solicitar el restablecimiento de la contrasena de la cuenta del empleado.

Tras un evento exitoso de restablecimiento de contrasena, el actor de amenazas establece la persistencia al inscribir su propio autenticador de MFA en la cuenta comprometida. Se ha observado que el actor de amenazas se inscribe en Okta Verify, autenticacion de llamadas de voz, SMS o manipula preguntas de seguridad, lo que le permite eludir la autenticacion multifactor (MFA) u otros controles de seguridad.

Despues de una vulneracion de cuenta exitosa, el actor se dirige a aplicaciones internas, apuntando especificamente a:

Aplicaciones de nomina como Workday, Dayforce HCM y ADPsuite. El acceso a estos sistemas se utiliza para manipular los datos bancarios de la cuenta comprometida.
Customer Relationship Management (CRM) e IT Service Management (ITSM) como Salesforce y ServiceNow. El acceso a estas plataformas podria llevar al robo de datos de clientes propietarios, propiedad intelectual o la manipulacion de los procesos de soporte de TI.
Suites de Colaboracion y Productividad: Office 365 y Google Workspace. El acceso a estos entornos proporciona una gran cantidad de informacion, incluyendo comunicaciones internas, documentos y credenciales, lo que facilita ataques adicionales.

Se ha observado que el actor de amenazas intenta autenticarse, y lo logra, desde una combinacion de servicios de anonimizacion y direcciones IP residenciales, como:

IPVANISH VPN
CYBERGHOST VPN
ZENMATE VPN
EXPRESS VPN
WINDSCRIBE VPN
STRONG VPN
ZENLAYER
Direcciones IP geolocalizadas en Nigeria

Varios sistemas operativos tambien estan asociados con esta actividad, incluidos, entre otros:

Mac OS 14.5.0 (Sonoma)
Mac OS 15.5.0 (Sequoia)
Mac OS 13.1.0 (Ventura)
Windows 11
iOS (iPhone)

respuesta ante amenazas

Lo que estamos haciendo

Estamos activamente involucrados en las siguientes actividades para mitigar esta amenaza:

Monitoreo continuo de la actividad del actor de amenazas.
Proporcionar orientacion y asistencia a las organizaciones para mejorar la seguridad de sus entornos Okta e investigar cualquier actividad sospechosa relacionada con cuentas potencialmente comprometidas.

Controles de proteccion

Recomendaciones

Inscriba a los usuarios en autenticadores robustos como Okta FastPass, FIDO2 WebAuthn y tarjetas inteligentes, y aplique la resistencia al phishing en la politica.
Documente, divulgue y cumpla con un proceso estandarizado para validar la identidad de los usuarios remotos que se ponen en contacto con el personal de soporte de TI, y viceversa. Considere el uso de servicios de verificacion de identidad cuando los usuarios esten bloqueados fuera de las cuentas.
Recomendamos crear roles de administrador personalizados para los profesionales de la mesa de servicio de primera linea. Esta funcion personalizada no debe tener los permisos necesarios para modificar los factores (restablecer contrasenas de usuario, establecer contrasenas temporales o restablecer o inscribir factores). En cambio, a estos profesionales de la mesa de servicio se les debe otorgar en su funcion personalizada el permiso para emitir Codigos de acceso temporal despues de que la persona que llama a la mesa de ayuda haya verificado correctamente su identidad. A diferencia de un token de restablecimiento de contrasena, un codigo de acceso temporal puede estar limitado por tiempo (sujeto a vencimiento), asignarse a grupos especificos de usuarios (NB: excluir a los administradores y otros objetivos de alto valor), encadenarse a otros autenticadores y estar sujeto a politicas de inicio de sesion de la aplicacion que restrinjan su uso por dispositivo o ubicacion.
Las politicas de autenticacion de Okta tambien se pueden utilizar para restringir el acceso a las cuentas de usuario en funcion de una variedad de requisitos previos configurables por el cliente. Recomendamos que los administradores restrinjan el acceso a aplicaciones confidenciales a dispositivos que son administrados por herramientas de administracion de extremo y protegidos por herramientas de seguridad de extremo. Para el acceso a aplicaciones menos sensibles, exija dispositivos registrados (utilizando Okta FastPass) que exhiban indicadores de higiene basica.
Denegar o requerir mayor seguridad para las solicitudes de redes poco utilizadas. Con Okta Network Zones, el acceso puede ser controlado por ubicacion, ASN (Numero de Sistema Autonomo), IP y Tipo de IP (que puede identificar proxies de anonimizacion conocidos).
Las evaluaciones de Okta Behavior y Risk se pueden utilizar para identificar solicitudes de acceso a aplicaciones que se desvian de los patrones de actividad del usuario establecidos previamente. Las politicas se pueden configurar para actualizar a nivel superior o denegar las solicitudes utilizando este contexto.
Capacite a los usuarios para que identifiquen indicadores de correos electronicos sospechosos, sitios de phishing y tecnicas comunes de ingenieria social utilizadas por los atacantes. Facilite a los usuarios la notificacion de posibles problemas mediante la configuracion de Notificaciones para el usuario final y elaboracion de informes de Actividad Sospechosa.
Adopte un enfoque de "Privilegios Cero Permanentes" para el acceso administrativo. Asigne a los administradores Roles de Administrador Personalizados con los minimos permisos necesarios para las tareas diarias, y requiera autorizacion dual para el acceso JIT (justo a tiempo) a roles mas privilegiados.
Aplique el enlace de sesion IP a todas las aplicaciones administrativas para evitar la reproduccion de sesiones administrativas robadas.
Habilite las Acciones Protegidas para forzar la reautenticacion cada vez que un usuario administrativo intente realizar acciones confidenciales.

Indicadores de Compromiso

Los contactos de seguridad de los clientes de Okta pueden iniciar sesion y descargar los Indicadores de Compromiso desde security.okta.com en el siguiente enlace:

https://security.okta.com/product/okta/help-desks-targeted-in-social-engineering-campaign-targeting-hr-applications

Una nota sobre el lenguaje de estimacion

Probabilidad	Casi ninguna posibilidad	Muy improbable	Poco probable	Aproximadamente posibilidades parejas	Probablemente	Muy probable	Casi cierto(mente)
Probabilidad	Remoto	Altamente improbable	Improbable	Aproximadamente posibilidades parejas	Probable	Altamente probable	Casi Seguro
Porcentaje	1-5%	5-20%	20-45%	45-55%	55-80 %	80-95 %	95-99%

North Korea's IT Workers expand beyond US big tech

Simon Conant, Alex Tilley — Sun, 28 Sep 2025 22:00:00 +0000

Okta Threat Intelligence ha realizado un analisis a gran escala que revela que el esquema de trabajadores de TI de la Republica Popular Democratica de Corea (RPDC) amenaza a casi todas las industrias que contratan talento remoto.

Si bien la elaboracion de informes publicos se ha centrado principalmente en ciudadanos de la RPDC que se dirigen a puestos de desarrollo de software en las principales empresas tecnologicas de EE. UU., nuestro analisis muestra que esta amenaza no se limita al sector tecnologico ni a los EE. UU. Los trabajadores de TI norcoreanos (ITW, por sus siglas en ingles) ahora representan una amenaza real para una amplia gama de industrias. Las industrias afectadas incluyen finanzas, salud, administracion publica y Professional Services en un numero creciente de paises. Este plan generalizado tiene como objetivo obtener empleo ilicito y, en algunos casos, robar datos confidenciales.

�Que tan amplia es esta amenaza? Nuestro analisis de miles de ejemplos de nuestra muestra de actividad de ITW de la RPDC encontro que las organizaciones de Informacion y Tecnologia representan solo la mitad de las entidades objetivo. Tambien encontramos que mas de una cuarta parte (27%) de las entidades objetivo tienen su sede en paises distintos de los Estados Unidos.

La Inteligencia de Amenazas de Okta observo ejemplos de actores vinculados a Corea del Norte (DPRK) avanzando a traves de multiples entrevistas para los mismos puestos. Si bien no estamos al tanto de los procesos de contratacion e incorporacion de cada organizacion, se observo evidencia de actividades corporativas posteriores a la incorporacion en multiples organizaciones en diferentes verticales, lo que respalda la teoria de que un enfoque amplio de "disparo disperso" para la aplicacion de empleo y la entrevista ha tenido el exito suficiente como para que valga la pena que el regimen de Corea del Norte continue y se expanda.

Es esencial que las organizaciones en todos los sectores industriales y paises sean conscientes de que los actores vinculados a la RPDC han solicitado o es probable que soliciten puestos tecnicos remotos anunciados y que implementen los pasos adicionales cruciales necesarios para que su organizacion sea un objetivo mas dificil.

Dentro de la investigacion: mas de 130 identidades y miles de empresas objetivo

Utilizando una combinacion de fuentes de datos internas y externas, Okta Threat Intelligence rastreo mas de 130 identidades operadas por facilitadores y trabajadores que participaban en el esquema ITW de la RPDC. Vinculamos a estos actores con mas de 6 500 entrevistas de trabajo iniciales en mas de 5 000 empresas distintas hasta mediados de 2025.

Con el fin de evitar alertar a los actores de amenazas sobre como obtuvimos visibilidad de sus actividades, Okta Threat Intelligence esta reteniendo deliberadamente algunos detalles sobre nuestra metodologia de investigacion. Nuestra confianza en los datos ha sido validada por sesiones informativas continuas con pares de la industria, agencias de aplicacion de la ley y organizaciones especificas.

Cabe destacar que existen similitudes superficiales entre los trabajadores de TI de la RPDC y los trabajadores de "pluriempleo" que no son de la RPDC, como los patrones de trabajo remoto, las motivaciones financieras, las tecnicas de engano y los origenes geograficos. Okta evalua cualquier identidad dada como alineada con la RPDC basandose en una combinacion de indicadores tecnicos, patrones de comportamiento y elaboracion de informes de primera mano del empleador. Ademas, anticipamos que las 130 identidades que Okta Threat Intelligence esta rastreando reflejan solo una pequena muestra de la actividad total activa de ITW de la RPDC.

Un problema en expansion

Durante al menos los ultimos cinco anos, la fuertemente sancionada RPDC ha movilizado a miles de personas a paises vecinos, encargandoles obtener empleo ilicito en paises desarrollados. Los trabajadores de TI de la RPDC dependen del fraude de identidad y la colaboracion de facilitadores en los paises objetivo para ayudarles a obtener y mantener el empleo.

La investigacion mas reciente de Okta revela tanto la amplitud de las industrias a las que se dirige como la duracion sostenida de esta operacion, lo que indica un esfuerzo de gran alcance y en evolucion para infiltrarse en empresas de todo tipo en los paises desarrollados. Un numero relativamente pequeno de personas pudo identificar anuncios de empleo, generar y enviar aplicaciones personalizadas (incluidos CV, cartas de presentacion y materiales de apoyo), pasar la evaluacion inicial de reclutadores o recursos humanos y asegurar entrevistas remotas a escala.

Si bien el objetivo principal del esquema ITW sigue siendo la ganancia financiera a traves del pago de salarios, han surgido numerosos informes de robo de datos e intentos de extorsion contra organizaciones que, sin saberlo, han empleado y posteriormente decidido despedir a estos trabajadores.

Incidentes ocasionales de exfiltracion de datos y extorsion, incluyendo actividad relacionada con ransomware, destacan la naturaleza de doble uso de esta campana. El acceso otorgado al colocar personal vinculado a la RPDC dentro de organizaciones occidentales proporciona una inteligencia significativa y capacidad de interrupcion en caso de que el regimen de la RPDC decida usarlo. El potencial de un acceso mas amplio y la recopilacion tecnica construida a traves de esta operacion de larga duracion deberia ser motivo de preocupacion para los gobiernos y las Organizations en la mayoria de los sectores de la economia.

Las unidades de ITW de la RPDC parecen estar aprendiendo de errores anteriores y estan apuntando a un mayor numero de industrias en un mayor numero de paises. Las entidades objetivo en esos paises ahora enfrentan una amenaza madura y experimentada que ha logrado el exito necesario para que se les haya otorgado un nivel de "libertad creativa" sobre las verticales objetivo y las herramientas, tecnicas y procedimientos que utilizan para obtener empleo.

Es posible que una mayor conciencia de esta amenaza, asi como los esfuerzos de colaboracion del gobierno y del sector privado para identificar y desarticular sus operaciones, puedan ser un factor adicional para que ataquen cada vez mas a roles fuera de los EE. UU. y las industrias de TI.

La RPDC esta ampliando sus objetivos desde las grandes tecnologicas hasta hospitales, bancos y mas alla

Nuestra investigacion demuestra un claro avance en las industrias y los roles que se estan enfocando en el esquema ITW.

Si bien los ITW de la RPDC buscan abrumadoramente puestos remotos de ingenieria de software, se observa cada vez mas que los ciudadanos de la RPDC solicitan puestos remotos de finanzas (procesadores de pagos, etc.) y puestos de ingenieria. Esto sugiere que los roles remotos de cualquier descripcion estan dentro del alcance del esquema. Siempre que la aplicacion, el proceso de entrevista y el trabajo en si puedan realizarse de forma remota, la RPDC intentara aprovechar la oportunidad para cobrar el pago financiero.

Nuestro analisis confirma que las aplicaciones de empleo se extienden a casi todas las industrias verticales principales. En los ultimos cuatro anos, podemos observar un aumento constante en el numero de sectores donde los trabajadores de TI han solicitado y asistido con exito a entrevistas de trabajo. Como era de esperar, las grandes empresas de tecnologia, especialmente aquellas que desarrollan software, siguen siendo los objetivos de mayor volumen. Sin embargo, otros sectores verticales, incluidos las finanzas, la salud, la administracion publica y los Professional Services, emergen constantemente en nuestro conjunto de datos, lo que demuestra una campana continua y de amplio alcance.

Existen varias explicaciones plausibles para la distribucion de entrevistas en los diferentes sectores verticales de la industria:

La distribucion es una funcion de que industrias anuncian la mayor cantidad de puestos remotos de ingenieria de software. Incluso entre las industrias que mas anuncian ingenieros de software, ciertas categorias de trabajadores del sector tecnologico, como las tecnologias blockchain o la inteligencia artificial, muestran un aumento en la cantidad de entrevistas que parece proporcional al aumento de la demanda de desarrolladores e ingenieros.
La distribucion refleja una focalizacion deliberada de industrias de interes para el regimen de la RPDC para fines distintos de la generacion de ingresos y/o las especializaciones o la experiencia de personas especificas.
No podemos descartar la posibilidad de que estos individuos simplemente tengan poca consideracion por la naturaleza o el negocio real de las empresas objetivo, mas alla de la naturaleza remota del puesto.

Los puestos mas atacados siguen estando en roles de desarrollo de software remotos (por ejemplo, React, full stack, Java), con valores atipicos ocasionales de oficina o especialistas como contabilidad, procesamiento de pagos y soporte de ingenieria. Nuestro analisis de la linea de tiempo tambien revela valles distintos en la actividad de entrevistas que coinciden con los periodos de vacaciones de EE. UU. y occidentales, lo que probablemente refleja desaceleraciones estacionales en la contratacion en lugar de un cambio en la intencion del adversario.

Una mirada mas profunda a los sectores verticales dirigidos hacia la RPDC

Okta Threat Intelligence selecciono un subconjunto de sectores verticales para un analisis mas profundo con el fin de ilustrar por que son objeto de ataques y el posible impacto de una infiltracion exitosa. Aunque los ejemplos se extraen de industrias especificas, las implicaciones se aplican de forma general y sirven como un llamado a la accion para todas las organizaciones.

Desarrollo de software y consultoria de TI

Los trabajadores de TI de la RPDC siguen centrandose abrumadoramente en el desarrollo remoto de software y en los puestos de consultoria de TI. Esto incluye no solo el empleo directo en empresas de tecnologia, sino tambien las colocaciones en grandes proveedores de servicios y subcontratacion. Estos puestos ofrecen salarios relativamente altos, acceso a bases de codigo, infraestructura y pipelines de desarrollo de gran valor, a la vez que son abundantes y, a menudo, remotos.

La investigacion de Okta muestra que estos actores identifican sistematicamente los puestos anunciados, elaboran curriculos y cartas de presentacion creibles, superan la evaluacion inicial de RR. HH. y consiguen entrevistas a gran escala. La combinacion del trabajo remoto, la contratacion por contrato y los equipos distribuidos crea un entorno en el que las verificaciones de antecedentes tradicionales y la verificacion de identidad pueden ser mas debiles, y la verificacion de identidad continua o recurrente inexistente. Esta exposicion se amplifica en las consultorias de TI, donde los trabajadores a menudo estan insertados en varias organizaciones de clientes, lo que aumenta el riesgo de acceso lateral. Okta Threat Intelligence tambien observo un uso significativo de plataformas de tienda de trabajadores independientes por parte de estos actores.

Inteligencia artificial

Desde mediados de 2023, Okta ha observado un marcado aumento en las entrevistas de trabajo vinculadas a Corea del Norte dentro de las organizaciones centradas en la IA, incluidas tanto las empresas de IA "puras" como las empresas que incorporan la IA en productos y plataformas existentes. Este aumento coincide con la expansion mas amplia del sector de la IA y la prisa por escalar los equipos de ingenieria, condiciones que pueden reducir el rigor de la evaluacion e incorporacion de los solicitantes.

Si bien parte de este aumento puede simplemente reflejar el auge general en la contratacion de IA, la exposicion de propiedad intelectual confidencial, datos de capacitacion de modelos y algoritmos patentados hace que este sector sea especialmente atractivo para los actores vinculados al estado. Okta evalua que es probable que los trabajadores de TI de Corea del Norte esten aplicando de manera oportunista a la creciente cantidad de puestos de IA en lugar de desviar recursos de otros sectores. Sin embargo, el potencial de doble uso del acceso a los sistemas de IA, particularmente para la manipulacion de modelos o futuras operaciones ciberneticas ofensivas, aumenta el riesgo estrategico.

Atencion medica y tecnologia medica

De manera mas sorprendente, observamos un numero constante de entrevistas de trabajo vinculadas a la RPDC entre organizaciones de tecnologia medica y de la salud. La mayoria de los puestos a los que se apunta se centran en el desarrollo de aplicaciones moviles, los sistemas de atencion al cliente y las plataformas electronicas de mantenimiento de registros (directamente con los proveedores de tecnologia relacionados con la salud, en lugar de empresas de servicios genericos). Estas areas brindan acceso potencial a informacion de identificacion personal (PII) confidencial, flujos de trabajo clinicos e infraestructura de datos de salud.

La superposicion entre la tecnologia y la salud ha transformado el sector en un objetivo de gran valor. Si bien las organizaciones centradas en la medicina a menudo pueden conocer bien la deteccion de credenciales medicas falsas "tradicionales" o un historial laboral preocupante, es posible que los trabajadores de TI y los codificadores contingentes no tengan el mismo nivel de escrutinio inicial o continuo. Es posible que las organizaciones de salud no cuenten con los recursos suficientes en la deteccion de amenazas internas para contrarrestar los intentos de empleo fraudulentos, y confien en los procesos de contratacion tradicionales que pueden no detectar a los impostores sofisticados.

En los EE. UU., la contratacion de personas vinculadas a paises sancionados para manejar informacion medica protegida podria tener importantes implicaciones regulatorias (por ejemplo, violaciones de HIPAA).

Okta Threat Intelligence evalua que es posible que los trabajadores de TI vinculados a la RPDC aun no esten atacando sistematicamente la salud, pero estan explotando la abundancia de funciones de desarrollo de *software* a medida que la industria se digitaliza, lo que aumenta los riesgos para la seguridad de los datos y la privacidad del paciente. Sin embargo, la sensibilidad de la informacion de identificacion personal (PII) de la salud la haria particularmente vulnerable al robo y la extorsion de datos.

Servicios financieros

Los trabajadores de TI de la RPDC constantemente se entrevistan para puestos en el sector financiero global. Las entidades objetivo incluyen instituciones bancarias tradicionales y empresas de seguros, asi como empresas FinTech modernas y organizaciones relacionadas con las criptomonedas.

Esto ofrece a la RPDC oportunidades de acceso directo a infraestructura financiera de alto valor, incluidos sistemas de procesamiento de pagos, datos de clientes y otros datos financieros.

Los roles a los que se dirigen se han expandido mas alla del desarrollo de software para incluir roles de back-office y procesamiento financiero en areas como la nomina y la contabilidad. Este cambio indica una comprension por parte de la RPDC de que existen otros tipos de tareas, mas alla de la ingenieria de software, que brindan oportunidades similares: una entidad objetivo debe estar preparada para contratar de forma remota, y un trabajador del conocimiento de la RPDC debe poder demostrar cierto nivel de competencia para llevarla a cabo.

La dependencia de los servicios financieros de reclutadores y proveedores de servicios externos para el talento especializado crea un entorno en el que la verificacion de identidad no la realiza directamente la organizacion que contrata. Esta exposici on es particularmente grave en los subsectores de las Finanzas Descentralizadas (DeFi) y las criptomonedas, donde una cultura de contrataci on r apida y remota puede crear importantes lagunas en la investigaci on, lo que permite a los actores obtener acceso confiable a las tesorer ias de activos digitales y a los protocolos centrales.

Gobierno y administracion publica

Okta observo un flujo pequeno pero persistente de entrevistas de trabajo entre trabajadores de TI vinculados a la RPDC y departamentos gubernamentales estatales y federales de EE. UU. entre 2023 y 2025, con ejemplos adicionales en entidades gubernamentales de Oriente Medio y Australia. Aunque nuestros datos no confirman si alguna de estas entrevistas resulto en empleo, los intentos demuestran que las agencias gubernamentales no son inmunes a la campana.

Mas significativa es la exposicion a la administracion publica a traves de contratistas gubernamentales, proveedores de servicios y consultorias. Estas organizaciones a menudo tienen un amplio acceso a las redes gubernamentales y a los proyectos confidenciales, pero se enfrentan a grandes volumenes de contratacion, plazos de entrega rapidos y grandes grupos de trabajadores remotos. Si las evaluaciones o los controles de acceso fallan, los actores de la RPDC podrian obtener acceso indirecto a los sistemas gubernamentales o a los repositorios de datos confidenciales. Okta evalua que los gobiernos y sus proveedores externos deben adoptar una verificacion de identidad inicial y continua rigurosa y una segregacion de acceso para reducir el riesgo de infiltracion.

Proveedores de servicios de externalizacion y de TI

Los grandes proveedores de servicios de TI y de externalizacion aparecen con frecuencia en los datos de Okta, lo que refleja su constante reclutamiento para puestos tecnicos remotos basados en contratos, exactamente el tipo de puestos que buscan los trabajadores de TI vinculados a la RPDC. Estas organizaciones suelen anunciarse a gran escala y procesan grandes volumenes de solicitantes, lo que aumenta las posibilidades de que un adversario se cuele.

Si bien muchas de estas empresas a menudo mantienen verificaciones de antecedentes y controles de seguridad solidos, el tamano de su fuerza laboral contingente y la naturaleza insertada de su personal en los entornos de los clientes crean un riesgo sistemico. Cualquier compromiso en un proveedor de servicios puede extenderse en cascada a varias organizaciones de clientes, lo que amplifica el impacto potencial. Okta evalua que las organizaciones deben tratar al personal proveedor de servicios y al proveedor de servicios como posibles amenazas internas y exigir a sus proveedores una verificacion de identidad, monitoreo y controles de acceso similares a los que se utilizan para los empleados directos. Los procesos comerciales y el acceso de los proveedores a los datos y sistemas deben limitarse estrictamente al minimo absoluto requerido, auditarse estrictamente y estar sujetos a una rigurosa evaluacion de riesgos.

El alcance global de la amenaza

El analisis de Okta Threat Intelligence revela, como se esperaba, que la gran mayoria de los puestos de trabajo objetivo (73%) fueron anunciados por empresas con sede en EE. UU. Los ejemplos de la campana de trabajadores de TI de la RPDC se identificaron por primera vez en los EE. UU. y han continuado alli a gran escala. Es probable que tambien haya algunos sesgos inherentes en el conjunto de datos que analizamos que sesgan nuestra muestra hacia objetivos con sede en EE. UU.

Dicho esto, nuestro analisis revela una expansion significativa de las operaciones de ITW a otros paises (27% del total/no estadounidenses), a menudo por los mismos actores de la RPDC que normalmente se han dirigido a puestos en los EE. UU. El Reino Unido, Canada y Alemania representan cada uno mas del 2% del total de observaciones (cada uno representa aproximadamente entre 150 y 250 puestos).

Amenaza en evolucion de una fuerza laboral madura

Okta evalua que, a medida que el enfoque de la operacion de trabajadores de TI de la RPDC se extiende globalmente, la amenaza para los empleadores en los paises recien atacados se eleva. Anos de actividad sostenida contra una amplia gama de industrias estadounidenses han permitido a los facilitadores y trabajadores alineados con la RPDC refinar sus metodos de infiltracion. En consecuencia, estan ingresando a nuevos mercados con una fuerza laboral madura y bien adaptada, capaz de eludir los controles basicos de deteccion y explotar los pipelines de contratacion de manera mas efectiva. Es menos probable que los nuevos mercados que puedan ver el esquema ITW como un "problema de las grandes tecnologicas de EE. UU." hayan invertido tiempo y esfuerzo en madurar sus programas de amenazas internas. Los aspectos educativos, tecnicos y de gestion de dicho programa requieren cierto tiempo y esfuerzo para ser efectivos.

La investigacion de Okta Threat Intelligence muestra un gran volumen de entrevistas de trabajo iniciales concedidas a trabajadores de TI vinculados a la RPDC en multiples sectores verticales. En este momento, tenemos menos confianza en las observaciones sobre que aplicaciones avanzaron mas alla de una primera entrevista. Nuestra muestra sugiere que, como maximo, el 10% de estos candidatos progreso a entrevistas de seguimiento.

Esta tasa de exito no deberia ser tranquilizadora para los empleadores. Okta solo analizo un pequeno subconjunto del numero total conocido de identidades fraudulentas vinculadas a las operaciones de trabajadores de TI de la RPDC. En la escala de esta actividad, incluso un pequeno numero de candidatos que progresan con exito a la segunda o tercera entrevista representa una amenaza significativa. Basta con una contratacion comprometida, especialmente en un puesto remoto privilegiado o de alto acceso, para permitir que los adversarios roben datos, interrumpan los sistemas o danen la reputacion y la confianza con los clientes. Los puestos de desarrollo de software a menudo requieren acceso elevado a datos y sistemas confidenciales, y estos permisos a menudo se otorgan desde el comienzo del empleo.

Se ha observado que estos actores utilizan diversos servicios en linea de idiomas y educacion tecnica para reforzar sus habilidades empleables. Tambien utilizan servicios de IA en sus intentos de empleo.

�Respuesta a la "presion del mercado"?

Los actores de amenazas en el esquema ITW han demostrado historicamente menos sofisticacion tecnica que sus contrapartes en las operaciones de espionaje y *ransomware* de la RPDC. Esto no ha disminuido su exito. Los operadores de ITW de la RPDC han ganado con exito decenas de millones de dolares para el regimen, y hemos observado suficiente variacion en sus tacticas a lo largo del tiempo para concluir que ahora disfrutan de una autonomia significativa.

Pero la operacion de ITW ahora enfrenta una nueva amenaza: una creciente conciencia y disrupcion coordinada de sus actividades. El escrutinio del esquema ITW de Corea del Norte dentro de su vertical mas especifica, el sector tecnologico de EE. UU., probablemente ha interrumpido su generacion de ingresos.

Las unidades de la RPDC encargadas de las operaciones de espionaje y ransomware ahora verian el modelo de contratacion de ITW como un vector no para obtener empleo y salarios incidentales, sino mas bien como una oportunidad para el robo y la extorsion de datos especificos y persistentes. Hay indicios tempranos de que el acceso de ITW ya esta siendo objeto de abusos para estos fines.

Las organizaciones que contratan a estas personas actualmente enfrentan riesgos relacionados con las sanciones y el dano a la reputacion. En el futuro, pueden enfrentar el robo de datos deliberado y dirigido y operaciones de extorsion que explotan el mismo acceso.

Implicaciones clave para las organizaciones objetivo

Los hallazgos de Okta revelan que la operacion de trabajadores de TI de la RPDC no es una amenaza de nicho confinada a las grandes empresas de tecnologia. Es una campana generalizada y a largo plazo dirigida a organizaciones en casi todas las verticales. Esto significa que cualquier organizacion que ofrezca puestos remotos o hibridos, especialmente en el desarrollo de software, los servicios de TI u otras disciplinas de trabajadores del conocimiento, es un objetivo potencial.

La escala y sofisticacion de la operacion demuestran que los procesos de reclutamiento tradicionales por si solos son insuficientes para evitar la infiltracion. Cada contratacion comprometida puede proporcionarle a la RPDC:

Beneficio financiero directo (pagos de salario desviados al regimen)
Acceso interno privilegiado a sistemas sensibles, datos y redes confidenciales
Aprovechamiento estrategico para ransomware, extorsion o actividad cibernetica de seguimiento
Perdida de secretos corporativos comercialmente sensibles
Recopilacion de inteligencia estrategica y acceso para el soporte de futuras operaciones ofensivas

Ademas, las organizaciones que contratan sin saberlo a actores de la RPDC corren el riesgo potencial de filtracion de facto de las obligaciones de las sanciones y la exposicion legal asociada.

Por lo tanto, las organizaciones deben adoptar una defensa en capas, que incluya una verificacion de identidad rigurosa durante la contratacion, un monitoreo continuo de los patrones de acceso y comportamiento de los trabajadores remotos y un claro plan de respuesta ante incidentes para gestionar las amenazas internas o de la cadena de suministro.

Pasos a seguir para contrarrestar esta amenaza

Okta Threat Intelligence evalua que las organizaciones en todos los sectores verticales -en particular aquellas que anuncian puestos remotos o por contrato- deben adoptar un enfoque proactivo y en capas para el reclutamiento, la incorporacion y el monitoreo de amenazas internas. Okta recomienda:

1. Fortalecer la verificacion de identidad del solicitante

Requerir verificaciones de identificacion emitidas por el gobierno en varias etapas de contratacion y empleo.
Verificar las ubicaciones indicadas con las direcciones IP (incluir la deteccion del uso de VPN), el comportamiento de la zona horaria y la informacion bancaria de la nomina.
Utilice servicios acreditados de terceros para autenticar documentos de identidad, empleos anteriores y credenciales academicas

2. Reforzar los procesos de contratacion y seleccion

Capacite a los departamentos de recursos humanos y a los reclutadores para que identifiquen las senales de alerta. Fomente los procesos que identifiquen si un candidato es intercambiado entre las rondas de entrevistas. Enseneles a identificar las senales de comportamiento, como el escaso conocimiento del area en la que afirman residir, la negativa a reunirse en persona, la negativa a encender la camara o eliminar los filtros de fondo durante las entrevistas, o la realizacion de entrevistas con una conexion a Internet muy deficiente. Identifique curriculums duplicados, cronogramas inconsistentes, zonas horarias que no coinciden y referencias no verificables. Evalue la huella en linea y la presencia en las redes sociales del candidato en comparacion con la informacion proporcionada. Cuando se proporcionen pruebas de trabajos anteriores, investigue si estos proyectos simplemente se clonaron de los repositorios de perfiles de usuario legitimos.
Verifique el historial de ediciones de CV y ??PDF en los metadatos del documento y otras "revelaciones" tecnicas asociadas con la duplicacion y la reutilizacion.
Anada verificacion tecnica y de comportamiento estructurada (codificacion en vivo o escritura realizada bajo la observacion del reclutador).
Requerir referencias de correo electronico corporativo (no webmail gratuito) y confirmar a traves de una llamada saliente a los numeros de la centralita principal de la organizacion de referencia.

3. Aplicar controles de acceso basados en roles y segregados

De forma predeterminada, asigne a los trabajadores nuevos o contingentes perfiles de minimo privilegio y desbloquee el acceso adicional una vez que se completen las comprobaciones de prueba.

Segmentar el desarrollo, las pruebas y la produccion; requerir la revision por pares y los flujos de trabajo de aprobacion para las fusiones e implementaciones de codigo.

Supervise los patrones de acceso anomalos (grandes extracciones de datos, inicios de sesion fuera de horario desde ubicaciones geograficas/VPN inesperadas, uso compartido de credenciales).

4. Supervisar a los proveedores de servicios y proveedores de servicios externos

Siempre que sea posible, exija contractualmente estandares continuos de verificacion de identidad, comprobaciones de antecedentes, politicas de autenticacion fuertes, lineas base de seguridad de dispositivos y derechos de auditoria.
Requiera cuentas de usuario con nombre (sin inicios de sesion compartidos ni cuentas de servicio internas donde sea posible) y acceso independiente a inquilinos/proyectos para cada entorno de cliente.

5. Implemente programas de concientizacion sobre amenazas internas y concientizacion sobre seguridad.

Establezca una funcion dedicada de riesgo interno o al menos un grupo de trabajo que abarque RR. HH., Asuntos Legales, Seguridad y TI.
Proporcione capacitacion especifica para reclutadores, gerentes de contratacion y lideres tecnicos sobre las tacticas de ITW y los controles de deteccion.
Educar y capacitar a los gerentes de contratacion y a los miembros del personal para que observen y presenten informes sobre comportamientos potencialmente extranos de sus pares que generen dudas sobre su identidad, objetivos y ubicaciones.
Crear canales de elaboracion de informes mas seguros para comportamientos sospechosos o preocupaciones de los candidatos.

6. Coordinese con las fuerzas del orden y con pares del sector.

Comparta los indicadores de compromiso y los patrones sospechosos de los candidatos con las unidades nacionales de delitos ciberneticos y los grupos ISAC/ISAO.
Desarrollar metodos para que el grupo de "riesgo interno" reciba y ponga en practica los indicadores (direcciones de correo electronico, direcciones IP, proveedores de VPN, creacion de documentos e indicadores de comportamiento) y este preparado para "compartir" los hallazgos relevantes.
Participa activamente en foros de intercambio de informacion para dar seguimiento a la evolucion de las tacticas y herramientas de ITW.

7. Realice evaluaciones de riesgos y ejercicios de equipo rojo con regularidad

Modelar las rutas de ataque de empleados internos y proveedores de servicios maliciosos; cuantificar el impacto potencial en el negocio.
Realice ejercicios de equipo rojo que prueben el pipeline de contratacion (aplicacion y entrevistas simuladas de la RPDC) para evaluar los procesos de verificacion de identidad.
Actualice los planes de respuesta ante incidentes para incluir escenarios que involucren amenazas internas maliciosas, proveedores de servicios comprometidos y revocacion de acceso acelerada.

Conclusion

El analisis de Okta demuestra que la campana de trabajadores de TI de la RPDC es una operacion a gran escala y sostenida. Si bien originalmente se dirigio a empresas de tecnologia de los Estados Unidos, la campana ahora abarca casi todos los sectores y multiples geografias.

La escala y duracion de la actividad indican un esfuerzo sistematico para obtener recursos financieros, acceso tecnico e inteligencia estrategica dentro de las Organizations. Un numero relativamente pequeno de identidades alineadas con la RPDC ha generado miles de entrevistas, lo que evidencia tanto la persistencia como la madurez del proceso. A pesar de la amplia conciencia de esta amenaza, los intentos de entrevista, la focalizacion y la metodologia continuan creciendo y evolucionando.

Si bien el desvio de nomina sigue siendo el motivador mas visible, el riesgo estrategico se extiende mucho mas alla de los salarios. Una colocacion exitosa de ITW puede permitir la filtracion de datos, la interrupcion operativa y el establecimiento silencioso de puntos de apoyo de acceso interno que pueden aprovecharse para el espionaje, la coercion o futuras operaciones ciberneticas.

Las organizaciones que todavia ven esto como un problema exclusivo de las "grandes tecnologicas" corren el riesgo de subestimar su exposicion. La evidencia presentada en este informe deberia servir como un llamado a la accion para reforzar los controles de reclutamiento y verificacion de identidad, elevar el monitoreo de los proveedores de servicios y proveedores externos, y asegurar que los planes de respuesta ante incidentes aborden explicitamente los vectores de entrada internos y de la cadena de suministro.

Con conocimiento temprano, verificacion rigurosa y defensa coordinada, las organizaciones pueden reducir sustancialmente la probabilidad de contratar candidatos fraudulentos y limitar cualquier impacto potencial derivado de la infiltracion.