Threat Intelligence | Blog | Okta

How to stop attackers from self-serving their way into accounts

Brett Winterford — Thu, 09 Jul 2026 16:00:00 +0000

Executive Summary

Over the last 12 months, Okta Threat Intelligence has observed a growing number of attacks in which users are tricked into approving attacker-initiated MFA enrollments and password resets.

We have observed numerous related clusters of activity in which threat actors have tested, iterated on, and scaled these social engineering attacks.

One in five of the proactive notifications Okta sent to customers over the last month related to phishing domains that included the string "passkey". The most recent campaign observed (O-UNC-066) used a passkey enrollment pretext to gain persistent access to Entra accounts.

Strengthening MFA enrollment and account recovery now needs to be a priority for every identity team, irrespective of platform or use case.

Threat Analysis

Until 2025, the largest share of social engineering activity we observed was impersonating IT support and other helpdesk staff to trick users into entering their password and OTP on attacker-controlled phishing sites.

This category of credential phishing is rendered ineffective when organizations require the use of phishing resistant authenticators in policy. Under phishing resistant policy conditions, even when a user is tricked into visiting an attacker-controlled site, the user is unable to share their access credentials.

Several clusters of threat activity have since adapted to their target's adoption of phishing resistance by using methods of attack that bypass the need to steal and replay a user's credentials.

The list of threat activity clusters below, presented chronologically from oldest to most recent, highlights some of these tactics.

Threat Actor	Targeted Process	TTPs
O-UNC-025	Enrollment (passkey enrollment)	Attacker impersonates the security team of the targeted organization to drive users to a phishing page that encourages them to set up a passkey.
O-UNC-028	Recovery (password reset)	Attacker impersonates the employer's IT helpdesk, lures targets to a phishing page and/or to authorize an attacker-controlled application.
O-UNC-045	Enrollment (passkey or authenticator app enrollment)	Attacker impersonates the employer's IT helpdesk in voice calls to drive targets to credential phishing sites.
O-UNC-053	Recovery (password reset)	Attacker impersonates the employer's IT helpdesk, and uses urgency around the need for a password reset as a pretext.
O-UNC-066	Enrollment (passkey enrollment)	Attacker impersonates the employer's IT team in voice calls to drive targets to credential phishing sites, uses stolen credentials to enroll an attacker-controlled passkey in the user's account.
O-UNC-067	Recovery (password reset)	Attacker simultaneously triggers the "forgot password" flow while on the call, socially engineers the user into approving the reset

Notably, we have yet to observe the threat actor Okta tracks as O-UNC-067 using credential phishing kits in order to take over accounts.

This intrusion actor, active since at least June 2026, selectively targets organizations configured to allow self-service password reset (SSPR).

The threat actor first performs reconnaissance on targets to assess whether a link to trigger a password reset is accessible, and to determine what MFA challenges apply to verify the user's identity when this password reset is triggered. If a SSPR option is enabled and the user is able to verify their identity during that flow using MFA factors that are not phishing resistant, the attacker calls their target while simultaneously triggering the password reset flow.

Breaking down the account recovery process

Minimum viable defense

Irrespective of whether a social engineering campaign targets authenticator enrollment (e.g., O-UNC-066) or targets authenticator recovery (e.g., O-UNC-067), the success or failure of the attack hinges on the target's org-level account management policies.

In the weakest account management configuration:

A password reset link is available on a public sign-in page
MFA enrollment policies allow verification of the user's identity via any MFA factor
MFA enrollment policies allow verification from any IP address

This configuration may be appropriate for some customer identity use cases, but less so for workforce customers. An attacker that has engaged a targeted user on the phone can trigger the password reset from their device while convincing the user to share an OTP or accept a push request to approve the reset event.

Okta administrators can very easily add friction directly in the MFA enrollment policy by:

Requiring additional verification (beyond a single factor challenge) to initiate the reset, and
Restricting the ability to use self-service features to trusted IP ranges.

This adds friction that prevents opportunistic attacks, but would not withstand a determined adversary. A social engineering actor that triggers the self-service event is in a position to select from a list of available verification challenges during recovery, and will always choose the weakest, most "phishable" method of authentication.

That's why every Okta customer should be taking a close look at Okta account management policies.

Applying phishing resistance to authenticator enrollment

Okta account management policies (AMPs) were originally introduced to support the authenticator lifecycle requirements of organizations that use passwordless authentication. Increasingly, these policies should also be viewed as a configuration tool that protects all authenticator enrollment and recovery flows from social engineering attacks.

AMPs offer administrators the same rich set of policy constraints to account recovery that were previously only available to authentication. AMPs can be used to require verification using phishing resistant factors, managed devices, trusted networks or a range of other criteria, effectively applying "zero trust" to the account recovery process.

Okta Threat Intelligence recommends the use of Okta account management policies to apply phishing resistance to authenticator enrollment and recovery. AMPs can require a user to verify their identity using a phishing resistant authenticator before they add or modify an authenticator.

In the strongest account management configuration available, user accounts are bootstrapped using pre-registered physical security keys, and the account management policy always requires that the user verifies their identity using a phishing resistant factor before they can add or modify an authenticator. This neutralizes attacks on both authenticator enrollment and recovery. Where (rare) edge cases emerge, Okta integrates with identity verification services that require a user to provide a government-issued ID and satisfy a liveness check to initiate recovery.

The next strongest approach is to use Okta AMPs, groups and event hooks to gradually raise the enrollment assurance bar for workforce users that are not already enrolled in a sufficient number of phishing resistant authenticators.

Under such a scenario, the top (first evaluated) AMP rule might allow a user to add or modify a factor if the request comes from a managed device and the user satisfies a phishing-resistant MFA challenge. The aim should be for all users to progressively be added to the group in scope for this rule and subsequently be constrained to only using phishing resistant factors during factor lifecycle events. Users that trigger policy rules beneath it should be prioritized for migration.

The next rule might constrain a user in whatever way possible until the user has enrolled in a sufficient number of phishing resistant authenticators. Users may be required to satisfy an Identity Verification (IdV) challenge, for example, or be temporarily allowed to verify their identity using weaker authenticators for their first few days of onboarding if they enroll from a trusted network. Event hooks or Okta Workflows can also be used to automatically advance users into groups with stronger assurance requirements as they meet the necessary criteria.

Always remember to add a catch-all deny as the final (bottom) rule in any policy, to prevent any unintended access scenarios.

Applying phishing resistance to authenticator recovery

The key to phishing resistant recovery is to enroll users in a sufficient number of phishing resistant authenticators to account for any loss or disruption of a single device.

One of the greatest strengths of the Okta Verify client is that there is zero marginal cost for a user to enroll multiple devices in their Okta Verify account. A user can enroll from their managed laptop and smartphone, for example.

When every workforce user is enrolled in multiple phishing resistant factors (Okta Verify installs) across more than one device, the number of account recovery events that require the helpdesk falls considerably. If a user loses a device or if the device is unresponsive, they will still have strong, phishing-resistant authenticators enrolled on a second device (e.g., smartphone vs laptop) or via an external security key which they can use to enroll a new or replacement device.

Subsequently there is no need to include a "forgot password" link on the sign-in page, and there is no need to offer weaker account management policies.

Indicators

Indicators associated with the clusters of activity discussed above are all available to the security contacts of Okta customers at:
https://security.okta.com/?product=oktathreatintelligence

Recommendations

ATT&CK technique	Tactic	Control
T1590 / T1591	Reconnaissance	Restrict recovery operations for workforce users to behind authenticated user settings. If a workforce organization is configured to support self-service recovery (the "forgot password" flow), consider restricting the IP range from which the sign-in page can be accessed to a known or trusted network using Okta network zones.
T1583 / T1584	Resource Development	Deny requests from known anonymizing services and proxies using enhanced dynamic zones.
T1566 / T1598	Phishing / Vishing	Enroll users in strong authenticators such as Okta FastPass, passkeys or smart cards and enforce phishing resistance in policy. Establish, communicate and evangelise methods of verifying the identity of helpdesk personnel when they contact users. Apply Okta account management policies that constrain the ability to modify authenticators. Apply temporary access codes as a preferred method for recovering access after identity verification.
T1078	Valid Accounts (Initial Access)	Okta authentication policies can be used to restrict access to user accounts based on a range of customer-configurable prerequisites. We recommend administrators restrict access to sensitive applications to devices that are managed by Endpoint Management tools and protected by endpoint security tools.
T1621	MFA Request Generation	Enroll users in strong authenticators such as Okta FastPass, FIDO2 WebAuthn, and smart cards and enforce phishing resistance in policy.
T1098.005	Account Manipulation - Device Registration	Apply Okta account management policies that constrain the ability to modify authenticators.

Nick Connolly contributed to this article.

Vishing actors target Entra passkey enrollment

Sun, 05 Jul 2026 16:00:00 +0000

Executive Summary

Since April 2026, a threat actor tracked as O-UNC-066 (also known as "Pink" by Palo Alto Networks Unit 42) has deployed a panel-controlled phishing kit targeting the passkey enrollment process for Microsoft 365 customers.

Okta has observed the targeting of enterprise organizations across the food and beverage, technology, healthcare, automotive, construction, and aviation industries by this cluster of activity. The primary motivation of the threat actors is data extortion.

The threat actor registers domains that incorporate the word passkey as part of a voice-enabled phishing ("vishing") scheme. The threat actor then calls targeted users on the phone in an attempt to persuade them that they need to register a new passkey.

Users are directed to a phishing kit that closely mimics the Microsoft passkey enrollment process. It appears engineered to convince a targeted user they are in the process of enrolling a passkey with Microsoft, while the threat actor simultaneously registers their own passkey in the targeted user's Microsoft account.

This pretext is well-timed - as of May 2026, Microsoft administrators have been able to create passkey registration campaigns that remind or "nudge" users to enrol in passkeys at sign-in, and in some circumstances these nudges are on by default.

Threat actors have used this well-intentioned security upgrade as a pretext for abusing the enrolment process to further their objectives.

Our analysis of the phishing kit revealed that it does not attempt to handle federation to third-party Identity Providers such as Okta. Subsequently, we have not observed the compromise of Microsoft accounts directly.

Threat Analysis

In the threat activity we observed, the threat actor creates per-target subdomains that mimic Microsoft Entra ID login pages. The pages are customized using each victim organization's legitimate branding. Generic Microsoft styling is loaded from Microsoft's Content Delivery Network, while the branding elements relevant to each victim organization (logo and background) is pre-staged per subdomain as part of the configuration for any given target and served from the backend of the phishing kit.

The kit is not a transparent Adversary-in-the-Middle (AitM) proxy, one of the most frequently seen types of phishing kits designed to collect credentials, MFA tokens and session tokens. It is an operator-controlled PHP panel in which a threat actor steers victims through various stages of authentication in close to real-time using a 1-second heartbeat polling mechanism. The operator can use the kit to adapt the user experience to each victim's MFA requirements (TOTP, push notification with number matching, SMS OTP) during the session. This operational design is consistent with the vishing tradecraft documented in Okta's November 2025 public blog post "Phishing kits adapt to the script of callers." The caller can control and adjust in real time what phishing pages and notifications a targeted user sees.

It is likely that the threat actor uses the kit to takeover the user account and trick the user into approving an attacker-initiated registration of a passkey.

Okta Threat Intelligence used code derived from the phishing kit to recreate the following flow, which closely resembles the passkey registration process for Microsoft Entra.

The first page of the phishing kit (/gate) reveals a page loading icon while the phishing kit performs anti-analysis checks. The second page (/identify) requests a username. The phishing kit did not redirect to a federated Identity Provider at the time of our analysis.

The next page (/password) challenges the user for a password. The captured credentials are sent in a POST request with a timestamp and Id to an operator panel at /backend.php.

Our assumption is that a phishing kit operator (which may be a different individual to the caller on the phone) captures the credentials of the targeted user within a few seconds and enters them at the legitimate Microsoft sign-in page for the targeted tenant.

The targeted user then sees a (/processing) page that presents another loading screen while the phishing kit awaits the operator's next instruction. Our assumption is that this small delay is required for a threat actor to authenticate to the user's legitimate Microsoft account using the stolen credentials, to observe what MFA challenges are presented, and select the next page of the phishing kit to present to the user.

next page of the phishing kit to present to the user.

If the operator chooses or is forced to complete an SMS OTP challenge, the user is directed to a page called /submit-otp. The captured OTP is sent in a POST request to the operator panel at /backend.php.
If the operator chooses or is forced to complete a TOTP challenge, the user is directed to a page called /submit-authenticator. The captured OTP is sent in a POST request to the operator panel at /backend.php.
If the operator chooses or is forced to complete a Push MFA challenge, the user is directed to a page called /approve-authenticator (see image below) and asked to enter the number supplied by the operator into their authenticator app.

At this stage of an attack, the user has been tricked over the phone into approving the attacker's access to their Microsoft 365 account.

In keeping with the passkey pretext, threat actors can then direct users to the /passkey/register page, which asks the user to create a passkey.

The phishing kit appears to prey on lack of user familiarity with passkey authentication. In a real passkey registration ceremony, the user might expect a system dialog to register a passkey on their device. The passkey pages in this phishing kit appear to mimic this process without registering a passkey.

At the /passkey page, the targeted user is presented with a Microsoft-branded page that encourages the user to "save your recovery key" from an attacker-controlled list of BIP-39 phrases. This closely resembles the methods used in some cryptocurrency applications to generate memorable seed phrases.

A subsequent /passkey/check page asks the user to verify the final word used in the seed phrase.

We are not aware of any direct applicability of BIP-39 seed phrases to Microsoft Entra or its passkey registration process. An attacker that has already gained unauthorized access to a user account can create their own recovery codes using a process that does not require any input from the real account holder.

It is likely that these passkey-themed pages are available to the phishing kit operator as a sleight of hand. It is a distraction to keep a user occupied on a task while the threat actor enrolls their own passkey in the legitimate Microsoft user account.

The /done page confirms that a passkey registration was successful. An unsuspecting user that does not fully understand how a passkey is enrolled may genuinely believe that they registered one with Microsoft simply by completing these otherwise meaningless tasks.

The operator can choose when to push the /done page to the user. At minimum it helps the phishing operation maintain the original pretext. Any time a user enrolls a passkey with Microsoft, the owner of the compromised account receives a legitimate Microsoft email to notify them that a new passkey had been registered in their account. During an attack, the passkey was actually enrolled by the threat actor directly with Microsoft, and the threat actor is in a position to name the passkey with something the targeted user would view as benign (perhaps even borrowing from the seed phrase selected by the targeted user). The passkey enrollment setup the targeted user experienced on the phishing site, by contrast, is likely to only exist to trick the user into thinking the attacker's enrollment was their own.

Infrastructure

Threat actors were observed creating subdomains for any given targeted entity under the following domains:

assignpasskey[.]com (2026-06-14, Internet Domain Service BS Corp., DDoS-Guard)
deploypasskey[.]com (2026-04-21, Tucows, DDoS-Guard)
passkeydeploy[.]com (2026-04-23, Internet Domain Service BS Corp, DDoS-Guard)
passkeyadd[.]com (2026-05-08, Tucows, DDoS-Guard)
setpasskey[.]com (2026-05-23, IQWeb FZ-LLC)

So a campaign targeting "exampleentity" might be something like:

exampleentity[.]setpasskey[.]com

The phishing infrastructure observed by Okta Threat Intelligence was hosted on DDoS-Guard (AS57724, Russia) and IQWeb FZ-LLC (AS59692, US).

Impact

The data extortion actors associated with the Pink phishing kit published a leak site on May 31, 2026. This site is used to extort and apply pressure to compromised entities in the public domain.

Recommendations

While this cluster of threat activity has not been observed impersonating Okta, similar campaigns have combined voice-based social engineering and operator-controlled phishing kits:

Public Blog Post (publicly available)

Phishing kits adapt to the script of callers

Flash Advisory (Okta customers only)

IT Support Impersonated in Requests for Password Resets

Threat Advisory (Okta customers only)

Vishing Operators Synchronize Phishing Sites to their Script for Hybrid Social Engineering Attacks

The recommendations below are specific to the defence of Okta customers.

ATT&CK

Tactic

Control Recomendation

T1566

Phishing

Enroll users in strong authenticators such as Okta FastPass, passkeys or smart cards and enforce phishing resistance in policy.

Establish, communicate and evangelise methods of verifying the identity of helpdesk personnel when they contact users.

T1078

Phishing

Deny requests from locations where your organization does not offer services. Okta network zones allow administrators to set policies that deny access to Okta-protected applications by geolocation (country), ASN, IP, or other criteria.

T1078

Valid Accounts
(Initial Access)

Okta authentication policies can be used to restrict access to user accounts based on a range of customer-configurable prerequisites. We recommend administrators restrict access to sensitive applications to devices that are managed by Endpoint Management tools and protected by endpoint security tools.

T1078

Valid Accounts
(Initial Access)

Notify users of every authenticator (factor) lifecycle event using end user notifications.

T1098

Account Manipulation (Device Registration)

Apply Okta Account Management Policies that constrain the ability to add or modify authenticators based on network context, device management status and enrolled authenticators.

Specific guidance is provided in a supplementary note attached to the customer-only version of this threat advisory at:
https://security.okta.com/product/oktathreatintelligence/vishing-actors-target-microsoft-entra-passkey-enrollment

Disrupting ShieldGuard: a security extension primed to drain crypto wallets

, Yang Wang, Simon Conant, Adam Smallhorn — Mon, 16 Mar 2026 16:00:00 +0000

Executive summary

Okta Threat Intelligence has discovered and helped industry partners to take down the infrastructure of a cryptocurrency scam called "ShieldGuard".

ShieldGuard claims to be a blockchain project that offers - through its promotion of a browser extension - a capability that blocks known threats to cryptocurrency wallets, such as phishing or malicious smart contracts.

The project was promoted using a multi-level marketing campaign in which users would be rewarded for early use of the extension (via a cryptocurrency "airdrop") and for promoting the capability to other users.

Our analysis of the browser extension, presented in detail below, revealed its true intent: ShieldGuard appears designed to harvest wallet addresses and other sensitive data for major cryptocurrency platforms including Binance, Coinbase, MetaMask, OpenSea, Phantom and Uniswap, as well as for users of Google services.

The extension also extracts the full HTML of pages after a user signs into Binance, Coinbase, OpenSea or Uniswap via their browser.

Threat analysis

ShieldGuard was promoted via a public website as a legitimate security application for users of Web3 services.

The creators of ShieldGuard also registered:

A listing in the Google Chrome Store
A social media profile at x[.]com
A Telegram channel

The web site and associated social media profiles for ShieldGuard claimed the extension would detect suspicious transactions prior to a user signing a request.

The creators of the browser extension attempted to drive downloads by launching an "airdrop".

An airdrop is a marketing campaign in which a blockchain-enabled service is "bootstrapped" by early adopters in the community. Early participants are issued coins or tokens that can be exchanged for some form of value if they sign-up prior to a specified date.

Interested users were encouraged to download the browser extension and sign-up for a user account at a claim portal in order to be eligible for the distribution of these tokens.

The ShieldGuard website reassured potential users that the software would not need direct access to their crypto wallets: the extension would poll a central server for updates on known threats and identify them in the user's browser.

Our analysis of the browser extension found that it includes a range of very different capabilities:

The browser extension harvests cryptocurrency wallet addresses from any website a user visits, using the EIP-6963 wallet discovery protocol
The browser extension exfiltrates full page content from cryptocurrency exchange and DeFi sites (which includes account balances, portfolio data, and transaction history)
The browser exfiltration is capable of executing arbitrary code on a device running the extension, as demonstrated through an ability to block access to legitimate websites on command and replace them with fake security warnings.
The browser extension tracks users via persistent UUIDs across all browsing sessions

Malware analysis

Analysis environment

To safely analyze the threat, we installed ShieldGuard browser extension and executed it within an isolated, containerized browser. Initial static analysis revealed that the extension's code was heavily obfuscated, a technique frequently employed by malicious actors to evade detection during review processes and to complicate reverse-engineering efforts.

Architecture and evasion techniques

ShieldGuard was revealed to be a sophisticated piece of malware designed to bypass the security restrictions of Chrome's Manifest V3. To achieve this, it bundles a complete custom JavaScript interpreter (vendor.js).

Bypassing Remote Code Execution Bans: Instead of using prohibited functions like eval(), the extension's background script fetches encoded script strings from a Command and Control (C2) server. It then uses its custom JS interpreter to parse and execute these scripts within the context of the victim's web pages. This allows the attackers to execute arbitrary remote code on demand without triggering Chrome's security policies.

Deceptive Permissions: Upon installation, the extension requests the permission to "Read and change all your data on all websites," granting it full access to the victim's browsing activity.

Malicious payloads and data exfiltration

Dynamic analysis confirmed the following attack flow:

A user with the browser extension installed navigates to a web site
The extension contacts the Command and Control server at shieldguards[.]net/scripts
The server returns the EIP-6963 wallet discovery script
The script discovers all installed wallets
The script extracts the wallet addresses from discovered wallets
All Ethereum addresses are extracted from discovered wallets
If the user has navigated to Binance, Coinbase, OpenSea or Uniswap, the extension waits for a set period of time before capturing the full HTML of the page
The HTML snapshot is exfiltrated

Our analysis found that the C2 server at shieldguards[.]net actively delivers two primary payloads:

Payload 1: Wallet address harvester (all websites):
A script is injected into every website the victim visits. It uses the EIP-6963 wallet discovery protocol to find all installed wallet extensions (e.g., MetaMask, Phantom, Coinbase Wallet), retrieve all associated Ethereum wallet addresses, and exfiltrate this list to the C2 endpoint at https://shieldguards[.]net/notifications.

This provides the attackers with a comprehensive inventory of a victim's wallets and their browsing habits.

Payload 2: Page content snapshot (targeted crypto sites):
For high-value targets, a second payload is delivered. After a five-second delay to allow the page to fully render, this script captures the entire page's HTML (document.documentElement.outerHTML) and sends it to https://shieldguards[.]net/snapshots. This allows the attackers to steal sensitive data directly from the DOM, including account balances, portfolio holdings, and transaction history.

Command & Control (C2) infrastructure

The browser extension communicates with a C2 server hosted at shieldguards[.]net, which is proxied through Cloudflare.

The key C2 endpoints identified were:


Endpoint	HTTP request method	Purpose
/scripts	POST	Delivers malicious JavaScript payloads.
/snapshots	POST	Receives exfiltrated page HTML.
/notifications	POST	Receives stolen data like wallet addresses.
/check/{domain}	GET	Determines if a domain should be blocked or appear "safe".
/uninstall	GET	Tracks when users uninstall the extension via a UUID.

Attribution and linked campaigns

There is potential that the threat actors are Russian-speaking, based on a Russian error string ("??????: ?? ??????? ?????????? ?????") and Cyrillic character support found within the custom JavaScript interpreter.

The investigation also uncovered strong links to another malicious campaign known as "Radex." We observed links between an administrative account used to set up an Auth0 tenant (radex4me@proton.me) and a Chrome extension ID associated with Radex (fkogigpebmhlbldifmjngmlooifljnif). It is very likely that both campaigns are operatd by the same threat actor.

Disruption

Okta Threat Intelligence has worked with industry partners to:

Disable all sign-in functionality
Remove the shieldguards[.]net domain from CDN services, revealing the website's origin server at Partner Hosting LTD, a bulletproof hosting provider
Remove the shieldguards browser extension from the Google Chrome Store
Remove the shieldguards[.]net domain from its domain registrar - which had the effect of disconnecting existing installs of ther browser extension from the C2 infrastructure.

Advice for end users

Beware the "too good to be true" trap

While legitimate sign-up promotions exist, scammers frequently use the promise of free crypto or high returns to create a false sense of urgency. If an offer looks too good to be true, it almost certainly is.

Practice safer online browsing

Browser plugins are a common source of malware. Installing them gives unknown third parties full access to your browser's window, history, and potentially your passwords and session cookies.

The best security advice is to limit if not eliminate browser plugins on the devices you use for access to sensitive accounts like crypto exchanges.

If browser plugins are absolutely required, follow these strict guidelines:

Official Sources Only: Only install plugins from official storefronts (Chrome Web Store, Mozilla Add-ons, or Apple Safari Extensions). Do not rely on the presence of an extension in these stores or positive reviews in these stores as markers of trustworthiness. Malicious browser extensions can present a strong rating until such time as the access they provide is abused.
Restrict Permissions: Configure browser plugins to only activate when clicked, or restrict them to only run on specific, necessary websites.
Regular Audits: Regularly audit your installed extensions to remove or disable unnecessary ones.
Compartmentalize: Use a completely separate, clean browser (or a strict Private/Incognito mode where all plugins are disabled) exclusively for crypto transactions and sensitive work.

Protect your crypto wallets

Safeguard your digital assets against browser compromises by using a reputable offline hardware wallet, diligently double-checking pasted addresses and enabling phishing-resistant MFA.

Advice for Okta customers

We recommend allowlisting strategies that provide security teams the ability to control the execution of third-party code on any browser used for access to corporate resources.

Two suggested approaches are provided below.

1. Deploy Managed Chrome:

Restricting local admin rights on managed company devices
Require a managed device for access to sensitive resources in Okta authentication policies
Deploy a Managed Chrome browser to user devices
Create an allowlist of approved browser extensions, removing the ability for users to add other extensions without admin approval
Create a process for users to request new extensions

2. Advanced posture checks:

Require a managed device for access to sensitive resources in Okta authentication policies
Deploy Okta Verify to user devices (using the latest version available in the Okta Admin Console)
Use advanced posture checks (part of Okta device assurance policies) to assess what browser extensions are running in the user browser at sign-in. Write authentication policies that allow access to sensitive resources from allowlisted browser extensions and deny access from all others.
Create custom remediation messages for users that are denied access to resources based on the extension running in their browser.
Create a process for users to request new extensions

Indicators of Compromise

Type	Indicator	Comment
AS Number	AS215826	Bulletproof host autonomous system serving malicious traffic
Chrome extension ID	olnppmocapoaecjhkiilemmnkjbmabfj	ShieldGuard tools extension ID
Chrome extension ID	fkogigpebmhlbldifmjngmlooifljnif	Radex extension ID

Vietnam-based cybercrime markets enable account sign-ups at scale

Mathew Woodyard, Angelos K. Marnerides, Michael Photiades, Jeremy Kirk — Sat, 28 Feb 2026 16:00:00 +0000

Executive summary

Okta Threat Intelligence, working with our partners at the University of Cyprus, have connected a cluster of fraudulent account registration activity to a sprawling cybercrime ecosystem based in Vietnam.

Fraudulent online accounts are more than just a nuisance; they are a critical tool for large-scale financial fraud. From spam to phishing to devastating interpersonal fraud scams, these accounts provide a veneer of legitimacy that allows criminals to abuse platforms and customers of those platforms.

In late 2025, Okta Threat Intelligence investigated signup fraud campaigns using infrastructure clusters internally designated as O-UNC-036 that relied on disposable email addresses in order to execute SMS pumping attacks, which is also known as International Revenue Sharing Fraud (IRSF). In this scheme, malicious actors automate the creation of puppet accounts in a targeted service provider. Fraudsters use these account registrations to trigger SMS messages to premium rate phone numbers and profit from charges incurred. This activity can prove costly for service providers who use SMS to verify registration information in customer accounts or to send multifactor authentication (MFA) security codes.

In the course of this investigation, Okta Threat Intelligence and our partners observed links from O-UNC-036 to dozens of websites that cater to individuals who want to conduct online fraud. This cybercrime-as-a-service (CaaS) ecosystem provides paid infrastructure and services that make it easier for other individuals to conduct online fraud. Many of these online storefronts sell user accounts that have been hijacked or created through automated means. This post will explain the threat that fraudulent registration poses to service providers, how it is executed and steps that can be taken to mitigate abuse.

Fuel for fraud

There is demand and a brisk trade for accounts on social media sites and services like LinkedIn, Instagram, Facebook, and TikTok. Fraudulent accounts can be leveraged in numerous ways that can impact the reputation of a service provider. Accounts can be used to send spam or to direct unsuspecting users to phishing sites. Fraudulent account registration is used to gain access to limited products such as concert tickets, to exploit free trials or manipulate product reviews. This all results in an erosion of trust in a service provider and a degraded experience for users.

Fraudulent accounts are also used to approach targets of interpersonal fraud scams: cyber-enabled crimes that range from investment and cryptocurrency scams to romance and sextortion schemes. Often referred to as "pig butchering," targets are persistently engaged online and over the phone in schemes designed to defraud them. These operations have exploded in recent years in southeast Asia, particularly in border areas near China, Myanmar, Thailand and Cambodia, and are run out of large compounds by organized criminal networks.

This activity has, according to an April 2025 report by the United Nations Office on Drugs and Crime, resulted in a "surge of specialized service providers" that feature a "range of merchants specializing in the sale of fraud kits, stolen data, malware, AI-driven tools, and various underground banking, money laundering and cybercrime services utilized by other criminals targeting victims globally."

This trade often happens in relatively open forums, on social networking sites, clear-web websites and on messaging platforms including Telegram. The tools enable fraud perpetrators to find targets, learn about them, gain their confidence and eventually cause them financial losses.

"When [scammers] use fake accounts to win the trust of people, they end up with a lot of personal data about them. They can do lots of damage to those victims," says Hieu Minh Ngo, a Vietnamese cybercrime investigator who contributed to the U.N. report and runs ChongLuaDao, nonprofit scam-fighting cybersecurity awareness organization.

The "web shops" we observed used website templates produced by a Vietnam-based web design and marketing company. We observed these cookie-cutter templates used for dozens of sites offering account-related products as well as other services used for fraud, such as falsely inflating the popularity of social media posts, phone farms for managing large numbers of accounts, residential proxies and "anti-detect" browsers, which are used to evade the tools used by security teams to detect account takeovers.

While the activity we observed predominantly targets Vietnamese speakers, many of the fake account vendors using these e-commerce templates also seek English-speaking buyers, extending the reach of this threat beyond Vietnam.

In December 2023, Microsoft undertook legal action against a Vietnamese CaaS group that sold fraudulent created Outlook and Hotmail accounts. The group, Storm 1152, created and sold 750 million fraudulent Microsoft Outlook and Hotmail accounts that were used for fraud, ransomware and extortion. The action temporarily disrupted Storm 1152. However, the group has since reformed, and Microsoft filed a second civil lawsuit in July 2024 in an effort to disrupt new infrastructure. We have not observed direct links between the activity we observed and Storm 1152.

Wanted: fake accounts

There is a chicken-and-egg problem fraudsters face when they need to create large numbers of synthetic user accounts with a service provider. Each new account requires a unique email address. Our insight into the fraudulent activity started with a set of disposable email domains used by O-UNC-036.

There are a variety of email services that offer "disposable" email addresses to cater to users with privacy concerns. These addresses can be generated en-masse and the services are often designed to cater to users that will likely only use an account for a short time. Correspondence to an address is typically available via an online service, and the email address provided may only be functional for as little as 10 minutes before being disabled. For fraudulent registrations, this arrangement is fine, since users of the service have no intention of actually using the address and may need only to view its inbox once to receive a verification code.

Okta Threat Intelligence observed a flood of suspicious-looking account registrations using multiple disposable email domains, which given the nature of the services is a red flag that the registrations are not being used for legitimate purposes. Our analysis of email provider domains turned up visual similarities that led us to a sprawl of web-based storefronts hosted in Vietnam and involved in the sales of web-based accounts.

All about MMO ("Make Money Online")

The website CMSNT.co appears similar to other marketing and website design services aimed at the e-commerce market.

"We design websites for your online money-making ventures," the site reads. "Automate your online money-making process."

What follows is a series of tiles that advertise website templates.

The website templates reveal a common theme: the sale of digital accounts for various types of services, including email providers, gaming sites, and social media services. However, there is no indication that CMSNT[.]co is involved itself in the sale of digital accounts or activity that could potentially violate computer crime laws.

Some templates are customized for the sale of accounts linked to video streaming, graphic design or AI chatbot service subscriptions, or for the sales of application software keys. Another template is a Social Media Marketing Panel, which appears to be designed as a storefront for a service that artificially boosts social media engagement on major social network sites. This inflation can include bogus "likes", comments or views. CMSNT[.]co says that "AI technology simulates real user behavior. No password required, just a public link. Trusted by over 15,000 customers."

Another template is customized for offering chron job services (scheduled tasks) using python, which can be used for tasks like web scraping.

Our research revealed that CMSNT[.]co's templates are used by dozens of websites. But not everyone is paying CMSNT[.]co to use them. At some point the source code for some templates was leaked, resulting in some entities using the templates without paying for licenses.

One of those freeloaders is Via17[.]com. "Via" is a slang term for hacked accounts, and it appears frequently on sites that are selling accounts. The compromised accounts may have been acquired using brute-force techniques, where attackers try different combinations of usernames and passwords, or from "logs" collected by information stealer (infostealer) malware. These types of malware logs, which can contain login credentials, payment card details, cryptocurrency wallet information and personally identifiable information extracted from infected devices, are routinely sold on underground forums and messaging platforms.

In an instructional video on YouTube, a person affiliated with the site bills Via17[.]com as the "#1 reputable website providing Facebook accounts." The video focuses on how people can access a Facebook account using a session token, which is a small data file that allows a user to remain signed into a website. Via17[.]com sells session tokens (also referred to as "cookies") as part of some fake account offerings.

One of the primary products at Via17[.]com is the resale of accounts from social networking sites. One package offers Vietnamese Facebook accounts with 10-50 friends with two-factor authentication enabled. More than 1,000 accounts are available at a price of 55,240 Vietnamese dong, or US$2.13 each. Other tiles advertise "vintage" Facebook accounts as old as 2006. Some accounts are listed as "real" accounts. It is unclear how Via17[.]com or its users have acquired them prior to sale. "Clone" accounts are created by software, according to the site. Depending on the type of account purchased, the data provided includes a userid, password, the ability to collect 2FA codes or notifications, a recovery email address and session tokens.

A similar account marketplace is nladsgiare[.]shop, which also runs the CMSNT[.]co website code. The advertisements for accounts on this site show the role that disposable email accounts play in the account trade. A section of the front page of the site advertises Facebook accounts that have Thai or "foreign" names that are linked to disposable email addresses from a service called mailclone[.]site.

Anyone can generate an email address on mailclone[.]site. Content sent to the address - such as an email verification link - is visible directly on the site. The same style of verification is recommended for accounts on Via17[.]com, with the site recommending buyers get codes sent to accounts from another free, temporary e-mail service, temp-mail[.]io.

Via17[.]com recommends 11 other disposable email services that can be used for account registration.

Conclusion

Preventing fraudulent account registration is a careful balance between preventing fraud and introducing undue friction on customers. (Users may be legitimately using masking or email forwarding services - consider Apple's Hide My Email feature). Organizations are typically prepared to tolerate a certain level of fraud to avoid events in which potential customers cannot complete a registration - this must be balanced against the risks an abundance of bogus accounts poses via a degraded customer experience.

Mitigations

Auth0

Auth0 customers have several tools at their disposal to mitigate fraudulent signups before, during and after the account creation process. Okta Threat Intelligence has written a playbook to guide efforts to mitigate abuse.

To protect their tenants from signup attacks, Auth0 customers can:

Use Bot Detection to challenge bots with a CAPTCHA of your choice within the configured risk tolerance.
Tighten Suspicious IP Throttling limits on signup to reduce the number of accounts attackers can make from individual IPs.
Create a Tenant Access Control List (ACL) rules, which denies observed malicious activity from sources based on indicators such as IPs, ASNs, geolocation values and JA3/JA4 signatures and has been shown to help mitigate signup attacks.
Enforce email verification using post-login Actions or a one-time password.
Block registrations that use known disposable email domains with pre-user registration actions.
Detect signup attacks with Auth0's open source Security Detection Catalog, especially the rules detecting risks of signup fraud by disposable domains and by volume and mass unverified account creation events.
Implement identity proofing tools, like those in the Auth0 Marketplace.

Okta Customer Identity

Okta Customer Identity also has controls that can be used to mitigate fraudulent sign up. Customers can block attackers before, during and after the signup process:

Identity Threat Protection, which is now in early access for Okta Customer Identity, evaluates IP reputation and looks at behavioral signals to block scripted account signups and signins and detect when threat actors use compromised credentials to sign up for accounts.
Use Okta APIs or Workflows to identify large batches of fraudulent registrations. Okta has published a sample workflow specifically to manage the abuse of self-service registration. The workflow compares the email address from a registration attempt and runs it against a customer-defined list of malicious or disposable domains. The workflow can be configured to deactivate these accounts.
Consider forcing verification of newly registered accounts via email link or OTP validation.

Consider performing identity-proofing with specialist third-party providers for users of high value services.
Consider blocking the most risky anonymizers and proxies by leveraging enhanced dynamic network zones. This stops attackers from reaching registration pages from high-risk services. Network blocking is the most extreme response and may not be an option for some.

Universities exposed to account takeover risk from contract cheating services

Mon, 16 Feb 2026 08:00:00 +0000

Executive Summary

Okta Threat Intelligence has identified extortion campaigns that target university students.

These operations often masquerade as "tutoring" or "proctoring" services, but function as contract cheating operations that feed sophisticated identity-theft and financial-crime rackets.

These extortion campaigns appear to first involve local and online recruiting efforts that seek students as clients.

In order for third parties to complete academic work on behalf of a student, students are asked to facilitate access for the proctoring services to academic systems, in some cases by sharing authentication credentials.

These third parties then press the students for further payment by threatening to expose the student for cheating.

The extortionists have been observed logging in from VPNs, residential, and mobile IP addresses in Kenya.

Okta Threat Intelligence has collaborated with several universities and people to study this activity, including Glen Woolley, Andrew Tolhurst, and Damien Mathieson of the Cyber Security Operations team at the University of Sydney.

This is not merely a matter of academic integrity; it is a threat to student safety and standards, the university's security perimeter and as one research institute posits, national security.

These extortion schemes target students across numerous universities in the English-speaking world, including the United States, Canada and Australia. Merely providing academic cheating services is illegal in some jurisdictions. For example, Australia criminalized contract cheating and ordered ISPs to block 555 websites offering these services. Regardless of jurisdiction, extorting students under threat of exposure is illegal.

There are broader risks to universities because of how the academic work is completed. Attackers demand full access to student accounts, which could mean the transfer of login credentials and approval of multifactor authentication challenges or other kinds of remote access. This grants threat actors an ongoing foothold within the university's environment.

While Okta Threat Intelligence has not directly observed a pivot from extortion to other abuses of student access in the clusters we are tracking, threat actors could conceivably leverage and monetize their access to achieve objectives such as payroll piracy.

Okta is committed to helping customers, partners, and users understand the critical role identity security plays in these attacks.

From contract cheating to student extortion

In order to finish their academic work quickly with minimal effort, some students choose to engage third parties to complete academic tasks in their behalf.

It is only after one of these third parties submits an assignment on behalf of a student through university apps like Canvas and Blackboard that the extortion component of these campaigns commences.

For instance, a student may pay $75 for one assignment, but after the assignment is submitted, the threat actor demands a further payment of $1,000 under threat of reporting the student. In almost all cases where the victim doesn't pay, the malicious actor will report the student. The malicious actor records voice and video communications with the student and may send emails to administrators.

Critically, the extortionists have leverage against their victims. Identity and access management logs may indicate that someone else has been using the student's account. The IP logs could show "impossible travel," meaning a student account was accessed locally and then some time later from a locale it would have been impossible for the student to now be located.

Lure mechanisms: the "academic support" facade

Threat actors use a multi-channel approach to find victims, often tailoring their language and platform to specific student demographics. The extortionists thrive in high-pressure moments, such as during finals week or mid-terms.

These services are advertised using both digital and physical channels.

Digital channels

The most common lures are digital, designed to look like academic notifications or helpful peer-to-peer recommendations.

Marketing emails: Attackers send emails to students with subjects like "Struggling with your Final?" or "Expert Tutors Available - Guaranteed A+." These often use professional-looking signatures to mimic official academic support messages.
Direct messaging (WeChat, WhatsApp, Telegram): To overcome email controls enforced by many universities that are likely to block, flag or filter out spam, attackers also use popular messenger apps used by international student communities. These messages are often written in the student's native language.
Websites: Contract cheating services develop professional-looking websites to give themselves an air of legitimacy.

Physical channels

Campus Postings: Accomplices of the attackers place physical flyers around campus.

Coerced referrals: Once a student is already being extorted, the threat actor may demand that the student recruits more classmates. This turns the victim into an accessory, spreading the lure through trusted peer networks.

Campaign Objectives

The primary objective of these campaigns is financial crime, achieved by extorting students based on evidence of authorized access.

The observed activity demonstrates clear intent to put students in a compromising situation in which they are either forced to pay or risk consequences from their academic institution.

Data collected by threat actors

The malicious actors try to collect as much personal information as possible to ensure the success of their extortion plot. These actors collect data such as:

Personally identifiable information (PII): Full name, home address, and phone number.
Institutional identifiers: Student ID number and official university email address.
Academic evidence: The assignment prompts, the student's personal notes, the completed assignment and even the course syllabus.
Proof of presence: Screen recordings or screenshots of the attacker logged into the student's portal (Canvas, Blackboard, etc.)

Risks beyond student extortion

Universities and Colleges are attractive targets for financially-motivated cybercriminal groups. We assess that contract cheating and extortion services have the potential to expose institutions to additional fraudulent activity if the extortionists we observed were to capitalize on the persistent access to systems granted by students.

Payroll piracy: The same credentials used to access student portals may provide access to payroll systems in those circumstances where a student also performs work for the institution. With access to payroll accounts, attackers can change bank routing information before a pay cycle, redirecting a student's wages to attacker-controlled accounts.
Financial aid fraud: The same credentials used to access student portals may provide access to financial aid portals, providing opportunities to divert loan disbursements or apply for additional fraudulent grants in the student's name.
Phishing and spam: Threat actors may also choose to abuse the high reputation of a trusted .edu email address to bypass spam filters and target faculty, staff, or administration in an attempt to gain access to higher-privileged accounts.
Research and IP Theft: The same credentials used for access to student portals may provide access to proprietary university databases, journals, or sensitive research data in specialized fields like defense and biotechnology.
Student discount harvesting: Threat actors may abuse student identities to resell products and services purchased with a student discount.

Threat Response

What we're doing

Okta is taking the following actions to mitigate this threat:

Proactively notifying institutions when we detect suspicious activity.
Providing guidance and assistance to organizations to enhance the security of their Okta environments and assisting them to investigate any suspicious activity related to potentially compromised accounts.
Maintaining ongoing working groups with higher education institutions.

Detections

In order to reach their objectives, attackers must have persistent access to the student's account long enough to run their extortion operation.

If the university is using Okta as an Identity Provider, there are several technical indicators that can point to evidence of unauthorized account takeovers.

What follows is a summary of detections available in the Okta platform.

Authenticator reuse: Attackers frequently register the same physical hardware such as a mobile phone to register as an MFA factor for multiple accounts that have been compromised. Analysts may see several student identities associated with the same device identifier in Okta logs, which is a strong sign of multiple account takeovers. Okta has a detection in the Customer Detection Catalog on GitHub for authenticator reuse here.

Session initiated by user, completed by attacker: This behavior involves the attacker logging in using the student's credentials from a remote location. However, the MFA prompt, such as a push notification, is accepted by the student from their normal IP geolocation. This creates a session where the root session ID originates from a suspicious IP while the successful authentication success comes from a trusted IP. Okta has created a detection for this scenario here.

Impossible travel: Student accounts that have been shared with contract cheating services will often show evidence of impossible travel. We routinely observe impossible travel scenarios where a student account logs in from their expected campus location but the event is followed almost immediately by a login from an IP address geolocated to Kenya, India or Pakistan. Often these aberrant IPs will solely login to Canvas, Blackboard or other assignment submission sites. Okta has a detection in the Customer Detection Catalog for impossible travel that is paired with a detection for a new device. Together, those are two key signals of a possible account takeover.

Intentional use of proxy services: Rather than merely being sloppy, we have observed threat actors intentionally use suspicious proxy services and IPs. This is part of their extortion operation: attackers leverage the impossible travel as evidence they can show university administrators. Use of IPs from unexpected locations, especially India and East Africa, can be indicative of an account takeover. Okta has a hunt in the Customer Detection Catalog for sign in attempts from proxies that customers can leverage.

Recommendations for Okta Customers

Utilize authenticator enrollment policy to block device enrollment to specific geo-locations and to block enrollment from proxy services
Block proxy services listed under the Network Indicators section below using dynamic network zones.
Block login or require step-up authentication from high risk or unexpected locations.

Network Indicators

Okta Threat intelligence has observed suspicious patterns of account access originating from Kenyan IPs. These IPs are not contained within one ASN, but frequently are associated with known suspicious proxying services:

RAYOBYTE_PROXY
NEXUS_PROXY
PROXYRACK_PROXY
IPCOLA_PROXY
KOOKEEY_PROXY
PLAINPROXIES_PROXY
LUMINATI_PROXY
9PROXY_PROXY
PROXYAM_PROXY
IPIDEA_PROXY
ABCPROXY_PROXY
NETNUT_PROXY

A note on estimate language

Okta Threat Intelligence teams the following terms to express likelihood or probability as outlined in the US Office of the Director of National Intelligence Community Directive 203 - Analytic Standards.

Likelihood	Almost no chance	Very unlikely	Unlikely	Roughly even chance	Likely	Very likely	Almost certain(ly)
Probability	Remote	Highly improbable	Improbable	Roughly even odds	Probable	Highly Probable	Nearly Certain
Percentage	1-5%	5-20%	20-45%	45-55%	55-80%	80-95%	95-99%

Detecting OpenClaw using advanced posture checks

Rafa Bono — Mon, 09 Feb 2026 16:00:00 +0000

OpenClaw is a free and open-source "personal AI assistant" that a user can connect to the local resources on their computer, messaging applications, calendars, and anything else they want the agent to access.

Right now, at least one of your users is experimenting with a personal assistant like OpenClaw. How you feel about that depends largely on the risk appetite of your organization, and how quickly you can spin up resources to assess the risk of this week's AI buzztoy. This stuff is coming at us fast.

A "personal AI assistant" doesn't need to be malicious or vulnerable for you to want to wrap some policy around its use on corporate-issued devices.

The facts are:

Personal AI assistants, by their nature, will seek broad system access - interacting with files, processes, and network resources - which makes it a powerful tool if it were ever abused.
Personal AI assistants may install persistence mechanisms like launchd services and binaries across multiple paths, making them difficult to fully remove.
The default listening port for these personal assistants could be exploited for remote access to your device or command-and-control.

The most conservative option would be to block the use of these technologies until your team has had some time to figure out how to use them safely. (See these tips from the Auth0 team if you're experimenting with OpenClaw).

You may also want to make access decisions for specific resources based on whether an AI assistant is downloaded, installed, or actively listening on a device used to access enterprise resources.

That's where Okta advanced posture checks can play a role. Advanced posture checks incorporates osquery-based posture evaluations on any device running admin-issued versions of the Okta Verify client.

By integrating detection queries like the samples provided below into advanced posture checks, organizations can automatically evaluate device health at authentication time and enforce access policies that, for example:

Block or restrict sign-ins from devices where OpenClaw is detected
Deny access to specific sensitive resources (apps) from devices where OpenClaw is detected
Trigger workflows that notifies administrators of a detection.

In all cases, administrators can create customized remediation advice for the user. Users can be instructed to take the actions necessary to restore access to specific resources, without having to call the IT helpdesk.

Sample queries

Let's assume OpenClaw is the personal AI assistant you want to check for. There are a number of approaches to detecting its use on a MacOS device.

Launchd

Let's start with persistent services/daemons by searching launchd for the term "OpenClaw". OpenClaw can be configured to launch at startup before you've even opened your terminal. This is part of the reason why personal AI assistants make people very, very nervous.

SELECT 1 AS result FROM (

    SELECT path

    FROM launchd

    WHERE name LIKE '%openclaw%'

    LIMIT 1);

Files

Advanced posture checks can also search for the presence of configuration files and binaries in common installation paths.

SELECT 1 AS result FROM (

    SELECT path

    FROM file

    WHERE path LIKE '/Users/%%/.openclaw/openclaw.json'

        OR path LIKE '/%%/.openclaw/%'

        OR path LIKE '/Users/%%/.volta/bin/openclaw'

        OR path LIKE '/Users/%%/.nvm/current/bin/openclaw'

        OR path LIKE '/usr/bin/openclaw'

        OR path LIKE '/usr/local/bin/openclaw'

        OR path LIKE '/opt/homebrew/bin/openclaw'

        OR path LIKE '/Applications/OpenClaw.app'

    LIMIT 1);

Running processes

Perhaps you're less concerned by whether OpenClaw has ever run on the machine, and more concerned about whether it's running while a user is signing in to protected resources?

SELECT 1 AS result FROM (

SELECT path

    FROM processes

    WHERE name LIKE '%openclaw%'

        OR cmdline LIKE '%openclaw%'

    LIMIT 1

);

Homebrew packages

OpenClaw leans on Homebrew for access to system-level dependencies. The presence of a homebrew installation with the name "OpenClaw" is another breadcrumb to follow.

SELECT 1 AS result FROM (

    SELECT path

    FROM homebrew_packages

    WHERE name LIKE '%openclaw%'

    LIMIT 1

);

npm package checks

The presence of an npm package of the same name also offers a detection opportunity.

SELECT 1 AS result FROM (

    SELECT path

    FROM npm_packages

    WHERE name LIKE '%openclaw%'

    LIMIT 1

);

Listening ports

By default, OpenClaw listens on several network ports:

18789 (TCP): The main port for the WebSocket Gateway, which coordinates connections between clients (CLI, web UI, mobile apps) and the AI agent.
18791 (TCP): Used for browser-based control/dashboard access.
9090: The application often defaults to using port 9090 for its service mode. Users frequently deploy OpenClaw using Docker containers, where mapping this port is necessary to access the service, commonly using 0.0.0.0:9090.

SELECT 1 AS result FROM (

    SELECT path

    FROM listening_ports

    WHERE port IN

('9090', -- Default OpenClaw self-hosted port.

'18789', -- The main port for the WebSocket Gateway.

'18791' -- Used for browser-based control/dashboard access.

        OR  path LIKE '%openclaw%'

    LIMIT 1

);

Installed applications

Advanced posture checks can also simply check if an app of this name is installed on the (MacOS) system.

SELECT 1 AS result FROM (

    SELECT path

    FROM apps

    WHERE name LIKE '%openclaw%'

        OR bundle_identifier LIKE '%openclaw%'

    LIMIT 1

);

Docker images

Advanced posture checks can also check for whether OpenClaw is running in a container. Here is a check for Docker images that use the name "OpenClaw"...

SELECT 1 AS result FROM (

    SELECT id

    FROM docker_images

    WHERE tags LIKE '%openclaw%'

    LIMIT 1

);

Docker containers

SELECT 1 AS result FROM (

    SELECT id

    FROM docker_containers

    WHERE image LIKE '%openclaw%'

    LIMIT 1

);

All together now

Given many of these detections rely on mutable names, a single query (or even two) might be prone to false positives. You may find that a few in combination deliver more consistent results.

The final query I'll leave you with attempts to detect the presence of OpenClaw on a macOS device by examining multiple system sources and combining the results into a single detection score.

Each source contributes a count of matches. These counts are summed into a final score:

Score ? 2 ? openclaw_detected = 0 (insufficient confidence of detection)
Score > 2 ? openclaw_detected = 1 (confident detection)

The threshold of 2 helps avoid false positives by requiring multiple indicators before flagging a device.

WITH launch_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM launchd

    WHERE name LIKE '%openclaw%'

),

 file_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM file

    WHERE path LIKE '/Users/%%/.openclaw/openclaw.json'

        -- OR path LIKE '/%%/.openclaw/%'

        OR path LIKE '/Users/%%/.volta/bin/openclaw'

        OR path LIKE '/Users/%%/.nvm/current/bin/openclaw'

        OR path LIKE '/usr/bin/openclaw'

        OR path LIKE '/usr/local/bin/openclaw'

        OR path LIKE '/opt/homebrew/bin/openclaw'

        OR path LIKE '/Applications/OpenClaw.app'

),

 claw_process AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM processes

    WHERE name LIKE '%openclaw%'

        OR cmdline LIKE '%openclaw%'

),

 homebrew_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM homebrew_packages

    WHERE name LIKE '%openclaw%'

),

 npm_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM npm_packages

    WHERE name LIKE '%openclaw%'

),

 netports_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM listening_ports

    WHERE port IN

('9090', -- Default OpenClaw self-hosted port.

'18789', -- The main port for the WebSocket Gateway.

'18791' -- Used for browser-based control/dashboard access.

        OR  path LIKE '%openclaw%'

),

 apps_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM apps

    WHERE name LIKE '%openclaw%'

        OR bundle_identifier LIKE '%openclaw%'

),

 docker_image_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM docker_images

    WHERE tags LIKE '%openclaw%'

),

 docker_container_claw AS (

    SELECT COALESCE(COUNT(*), 0) as total

    FROM docker_containers

    WHERE image LIKE '%openclaw%'

),

 final_score AS (

     SELECT

        + file_claw.total

        + claw_process.total

        + homebrew_claw.total

        + npm_claw.total

        + netports_claw.total

        + apps_claw.total

        + docker_image_claw.total

        + docker_container_claw.total

        AS score

     FROM launch_claw, file_claw, claw_process, homebrew_claw, npm_claw, netports_claw, apps_claw, docker_image_claw, docker_container_claw

 SELECT

    CASE

        WHEN score <= 2 THEN 0

        WHEN score > 2 THEN 1

    END AS openclaw_detected

 FROM final_score

More clawsome detections

Detecting the presence of a new and unverified application like OpenClaw is one of numerous ways in which advanced posture checks can be used to ensure resources are only accessed from devices exhibiting strong hygiene.

Stay tuned for more!

The North Korean on your payroll

Wed, 28 Jan 2026 16:00:00 +0000

In September 2025, Okta Threat Intelligence published research from a large-scale analysis into fraudulent employment schemes conducted by Democratic People's Republic of Korea (DPRK) IT Workers (ITW).

That research collated data from over 130 actors, conducting over 6500 interviews with 500 companies.

In this post, we look specifically at the activities of two individual personas. We selected these two examples from a large list of actors that we continue to track because they exemplify the typical tools, techniques and procedures (TTPs) employed by DPRK ITW actors. Additionally, each had novel observables that can further inform defenders against these efforts.

These two actors reveal two interesting TTPs DPRK actors use to land employment: the abuse of legitimate LinkedIn profiles to pass reference checks, and the abuse of stolen identities.

#1 - Meet "JJ"

The first of the two actors we will detail we'll refer to as "JJ". This actor has prolifically interviewed for roles in multiple verticals over two years, with an overrepresentation of roles in AI and healthcare.

The email account used by this actor is similar in structure to other DPRK-linked actors, in that it utilizes a free webmail service and the account name incorporates references to software development and other randomized alphanumeric characters. Open-source intelligence (OSINT) research conducted into the email address used by this actor uncovered a number of online services accounts that are very typical of DPRK ITW actors. All of these accounts are used exclusively for job applications and associated tasks:

Job board and hiring platforms
Scheduling platforms popular with recruiters
Document organization workspaces with AI assistance
Dynamic DNS services
Online coding platforms

While not observed with this specific actor, Okta Threat Intelligence has also used OSINT techniques to observe email addresses used by DPRK actors being registered to the following services:

Freelancer employment platforms
Article authoring and publishing platforms
Document creation and managements
Language learning platforms
Online communications
Software development social platforms
Online PDF platforms
Coding assessment platforms

DPRK actors use these online accounts and fabricated resumes to effectively create an artificial "persona". These personas appear "out of thin air", inheriting the online presence required for a professional applying for roles, but without any evidence of personal use of any internet services. The exclusive use of these specific services, combined with the absence of any personal online footprint, creates a pattern highly indicative of an artificial persona.

Additional "tells" very common to these actors can sometimes be observed in the document properties of PDF resumes they provide. Okta Threat Intelligence can provide customers with further details on these methods of detection - please talk to your account manager to find out more.

Becoming JJ

During the two years of observed activity, our threat actor JJ created and subsequently abandoned several personas.

Until recently, JJ told recruiters that he did not have a LinkedIn profile. Okta Threat Intelligence occasionally observes LinkedIn profiles associated with the persona email addresses set up by DPRK ITW actors. The scarcity of connections, posts, recommendations, other content, and activity on these profiles can be used to identify a lack of authenticity. Often we discover that a LinkedIn profile listed by a DPRK ITW actor has been disabled thanks to the detection and enforcement efforts of the LinkedIn security team.

In September 2025, JJ was observed providing recruiters an active LinkedIn profile for the first time. The LinkedIn profile matched the inauthentic name they were using to apply for roles at the time, and doesn't feature a profile picture. At first glance, the LinkedIn profile appeared robust and realistic, unlike most LinkedIn profiles established for DPRK IT Worker fraud. For example, the profile had:

Almost 200 connections
Links to a GitHub account with realistic content (see later in report for example of an unrealistic GitHub account)
Multiple "skills" listed, many of which were endorsed by multiple third-parties. The endorsing LinkedIn accounts appeared to be authentic.

A happy false-positive

Our investigation determined that the person represented in the LinkedIn profile was, until recently, a genuine employee of the listed organization.

Our assessment is that the actor has simply misrepresented a genuine Linkedin profile as their own, altering the name of their fraudulent persona to fit that of a real human to align with the employment criteria. Our confidence in this assessment was also based on the fact that the DRPK actor's email address was not the email address used for the legitimate LinkedIn profile. It was a form of "stolen valour" designed to increase their chances of employment.

A challenge for verification

This technique - creating a persona based on a real identity - reinforces the need for strong identity verification prior to any form of employment. Employers should not rely on a LinkedIn profile as a basis for determining employment history. Verification requests to current or recent employers, asking only if a person with that name was employed in the role in the timeframes listed on LinkedIn, will not reveal the fraud. It is trivial for a threat actor to employ this technique, or to generate resumes directly from a co-opted Linkedin profile using an online resume generator or an AI-augmented system that consumes a public profile as an input. The actor simply creates an altered email address and phone number and makes the task of an HR screener far more demanding.

Prospective employers should incorporate identity verification techniques such as mobile drivers license verification. If relying on knowledge factors, verifiers should only base assessments on definitively non-public information such as partially-redacted national ID number or the name of the last manager at the role. Employers cannot rely on date of birth for robust verification as this information is readily available in public data and people-search services.

#2 "EM" gets hired

We will refer to our second actor as "EM". EM's employment fraud activity stretches back over a year, with hundreds of interviews again across all verticals, but very much favoring AI-related roles and organizations. Okta Threat Intelligence also observed EM interviewing with sensitive critical national infrastructure (CNI) organizations such as commercial aviation, communications providers, internet service providers, a voting technology company and intelligence and defense contractors.

EM has a statistically high occurrence of succeeding in first interviews and being offered multiple rounds of interviews with individual organizations, and is likely to have been hired by several organisations into software development roles.

We set out to discover some of the secrets to EM's success.

The co-opted persona used by EM appears to have been crafted based on an online photograph of a legitimate person who unfortunately also displayed enough information online to enable the DPRK (and potentially others) to co-opt his identity.

The real EM and an identity problem

EM claims to be a US citizen when asked about employment eligibility, and presents very realistic identity documents. Research into the name used by this actor finds that there is only one real person with this distinct name. We found photos of a person, holding up an identity document almost identical to the document our actor presents as his own, with a different photograph and signature.

The DPRK EM

EM's professed residential and employment history differs significantly from that of the real person whose identity was assumed. Okta Threat Intelligence observed EM offering two different contact phone numbers. Both are VoIP phones - ubiquitous with DPRK actors - and one has a Caller ID location that contradicts their professed biography. The LinkedIn profile listed in their resume has since been taken down by the team at LinkedIn.

lookup cname = SEATTLE WA
lookup cname = WESTPORT WA

DPRK ITW actors often create impressive-looking GitHub accounts to backstop their technical proficiency for job interviews. EM is no exception to this.

A GitHub account used by EM has thousands of contributions, ostensibly dating back to 2011.

However it appears that EM forged most of the commit dates .

The actual earliest contribution date from EM in this account can be determined using the GitHub API (see request response below), which returns a date of December 2024, not 2011.

?  ~ curl -s https://api.github.com/repos/em???????/D??????-W?????? | jq -r '.created_at'

2024-12-14T??:??:00Z

This actor simply changed the year of their unsigned commit date from 2024 to 2011.

The many (AI) faces of EM

The face of EM, as presented in various online profiles, is inconsistent. None of them are at all similar to the image used in EM's forged identity documents.

They appear to the human eye as likely AI creations, and multiple online AI-detection tools offer mixed-high confidence assessments when asked if the profile pictures were AI generated.

A third profile picture, likely sourced from a now-deleted LinkedIn account, lacks the necessary resolution to accurately determine if it was AI-generated. It is again clearly not the same as the forged identity or other AI-generated images used by the actor.

The other DPRK EM?

During the course of our research, Okta Threat Intelligence assessed two additional professional profiles with a distinctly different biography and profile picture that tools identified as likely not being AI-generated.

As the table below shows, the two profiles show a very different story. This may be a different DPRK ITW actor using the same identity, or an earlier iteration of EM's fictional biography.

Your new (DPRK) hire

During our research, we often make assessments as to whether a DPRK ITW actor has successfully been hired into a role. In this case we can say with high confidence that EM has been hired: thanks to a LinkedIn post by their new employer, welcoming their newest hire.

The photo used in this post is even more obviously AI-generated than any of the other photographs we analyzed.

Steps have been taken to contact this organization to inform them of our observations.

Conclusion

Just as with genuine candidates hunting for work, the vast majority of interviews with DPRK facilitators and agents do not progress to a second interview or job offer.

Some actors however seem to be more competent at crafting personas and passing screening interviews. Their skill isn't limited to an ability to impress a prospective employer, but also to the tools and techniques that DPRK ITW actors use to try to obfuscate their actual origins.

Given the vast quantities of job applications and interviews being conducted, the various operators in the IT Worker scheme are clearly "learning from their mistakes" - in many cases duplicating approaches (CV structure and elements, Linkedin profile construction and interview support technologies) that have succeeded in progressing one application over another. A kind of IT Worker natural selection is at play. The most successful actors are very prolific, and scheduled hundreds of interviews each. We consider it likely that they often act as "interview brokers" in order to land employment positions that are then handed over to other DPRK ITW actors.

The third-party contractor risk

Our research revealed a large number of DPRK IT Workers seek temporary contract work as software developers hired out to third-party organizations. We assess that these companies are potentially less likely to enforce rigorous background checks on these short-term fixed task employees than the companies that they are contracting to would for direct-hire employees.

This highlights the importance of performing such checks not only on direct-hire employees, but also on all individuals given access to company resources via third-party service providers.

Background checks can never be optional

In this report we've highlighted an example of the deliberate co-option of the identity of a genuine person, together with their professional history. Rigorous background checking and employment verification will be needed to pierce this identity misrepresentation. Yet we also observed the hiring of an actor whose artificial identity would not stand up to even the most cursory use of a search engine.

Organizations that unwittingly hire a DPRK actor risk a potential de facto breach of sanctions obligations and associated legal exposure. Each compromised hire can also provide the DPRK with:

Direct financial gain (salary payments diverted to the regime)
Privileged internal access to sensitive systems, data, and networks
Operational leverage for ransomware, extortion, or follow-on cyber activity
Loss of commercially-sensitive corporate secrets
Strategic intelligence collection and access to support future offensive operations

Organizations should therefore adopt a layered defense, including rigorous identity verification during recruitment, ongoing monitoring of the access and behaviour patterns of remote workers, and a clear incident response plan for managing insider or supply chain threats. When hiring for positions of elevated trust and access, in-person verification of identity and documents and collection/provision of equipment and access tokens is a relatively small cost given the risk the organization is taking on. Access for remote employees and especially third-party contractors should be strictly limited to the minimum required to perform their role.

Steps to take to counter this threat

Okta Threat Intelligence assesses that organizations across all verticals - particularly those advertising remote or contract roles - should adopt a layered and proactive approach to recruitment, onboarding, and insider-threat monitoring. Okta recommends that organizations:

1. Strengthen applicant identity verification

Require verifiable government-issued ID checks at multiple stages of recruitment and employment
Cross-check stated locations with IP addresses (include VPN usage detection), time-zone behaviour, payroll banking information and delivery addresses provided for shipping hardware.
Use accredited third-party services to authenticate identity documents, prior employment, and academic credentials

2. Tighten recruitment & screening processes

Train HR and recruiters to identify red flags. Encourage processes that would identify whether a candidate is swapped out between rounds of interviews. Teach them to identify behavioural cues such as poor knowledge of the area they claim to reside in, a refusal to meet in person, a refusal to turn on camera or remove background filters during interviews, or interviewing using a very poor internet connection. Identify duplicated resumes, inconsistent timelines, mismatched time zones and unverifiable references. Assess the candidate's online footprint and social media presence against the information provided. Where evidence of previous work is provided, investigate whether these projects were simply cloned from the repositories of legitimate user profiles.
Verify the history of edits to CVs and PDFs in document metadata and other technical "tells" associated with duplication and reuse.
Add structured technical and behavioural verification (live coding or writing performed under recruiter observation).
Require corporate email references (not free webmail) and confirm via outbound call to the main switchboard numbers of the reference organization. Ensure these references incorporate elements other than revealed in for example public LinkedIn profiles, such as last-manager's name.

3. Enforce role-based and segregated access controls

Default new or contingent workers to least-privilege profiles and unlock additional access once probationary checks are complete.
Segment development, testing and production; require peer review and approval workflows for code merges and deployments.
Monitor for anomalous access patterns (large data pulls, off-hours logins from unexpected geos/VPNs, credential sharing).
Employ access certification campaigns to govern ongoing access.

4. Monitor contractors and third-party service providers

Where possible, contractually mandate ongoing identity verification standards, background checks, strong authentication policies, device-security baselines and rights to audit.
Require named-user accounts (no shared logins or internal service accounts where possible) and separate tenant/project access for each client environment.

5. Implement insider-threat and security awareness programs

Establish a dedicated insider-risk function or at least a working group spanning HR, Legal, Security, and IT.
Provide targeted training for recruiters, hiring managers, and technical leads on ITW tradecraft and screening controls.
Educate and empower hiring managers and staff members to observe and submit reports of potentially strange behaviour by their peers that raise questions as to their identity, goals, and locations.
Create safer reporting channels for suspicious behaviour or candidate concerns.

6. Coordinate with law enforcement and industry peers

Share indicators of compromise and suspicious candidate patterns with national cybercrime units and ISAC/ISAO groups.
Develop methods for the "insider-risk" group to receive and action indicators (email addresses, IP addresses, VPN providers, document creation, and behavioural indicators) and be prepared to "share back" relevant findings.
Actively participate in information-sharing forums to track evolving ITW tactics and tooling.

7. Conduct regular risk assessments and red-team exercises

Model insider and malicious contractor attack paths; quantify potential business impact.
Perform red team exercises that test the hiring pipeline (simulated DPRK application and interviews) to assess identity verification processes.
Update incident response plans to include scenarios involving malicious insiders, compromised contractors, and expedited access revocation.

Okta Threat Intelligence appreciates the assistance of Epieos in the research for this post.

Phishing kits adapt to the script of callers

Thu, 22 Jan 2026 08:00:00 +0000

Okta Threat Intelligence has detected and dissected multiple custom phishing kits that have evolved to meet the specific needs of voice-based social engineers ("callers") in vishing campaigns.

These custom kits are made available on an as-a-service basis and are increasingly used by a growing number of intrusion actors targeting Google, Microsoft, Okta and a range of cryptocurrency providers.

The kits are capable of intercepting the credentials of targeted users, while also presenting the supporting context required to convince users to approve MFA challenges, or to take other actions in the interests of the attacker on the phone. They can be adapted on the fly by callers to control what pages are presented in the user's browser, in order to sync with the caller's script and whatever legitimate MFA challenges the caller is presented with as they attempt to sign-in.

"Once you get into the driver's seat of one of these tools, you can immediately see why we are observing higher volumes of voice-based social engineering," said Moussa Diallo, threat researcher at Okta Threat Intelligence. "Using these kits, an attacker on the phone to a targeted user can control the authentication flow as that user interacts with credential phishing pages. They can control what pages the target sees in their browser in perfect synchronization with the instructions they are providing on the call. The threat actor can use this synchronization to defeat any form of MFA that is not phishing-resistant."

Okta Threat Intelligence has published a detailed threat advisory for customers that provides an inside look at the capabilities of two such kits used by intrusion actors. This blog post summarizes the key features that make these kits so effective.

When all else fails, hit the phones

The phishing kits appear, based on common features, to have evolved from the same lineage to specifically meet the needs of callers that are interacting with targeted users in real-time.

The most critical of these features are client-side scripts that allow threat actors to control the authentication flow in the browser of a targeted user in real-time while they deliver verbal instructions or respond to verbal feedback from the targeted user. It's this real-time session orchestration that delivers the plausibility required to convince the threat actor's target to approve push notifications, submit one time passcodes (OTP) or take other actions the threat actor needs to bypass MFA controls.

Attacks tend to follow a similar sequence:

The threat actor performs reconnaissance on a target, learning the names of users, the apps they commonly use, and phone numbers used in IT support calls;
The threat actor sets a customized phishing page live and calls targeted users, spoofing the phone number of the company or its support hotline;
The threat actor convinces the targeted user to navigate in their browser to the phishing site under the pretext of an IT support or security requirement;
The targeted user enters their username and password, which is automatically forwarded to the threat actor's Telegram channel;
The threat actor enters the username and password into the legitimate sign-in page of the targeted user and assesses what MFA challenges they are presented with;
The threat actor updates the phishing site in real-time with pages that support their verbal ask for the user to enter an OTP, accept a push notification, or other MFA challenges.

This real-time session orchestration provides a new level of control and visibility to the social engineer. If presented a push notification (type of MFA challenge), for example, an attacker can verbally tell the user to expect a push notification, and select an option from their C2 panel that directs their target's browser to a new page that displays a message implying that that a push message has been sent, lending plausibility to what would ordinarily be a suspicious request for the user to accept a challenge the user didn't initiate.

It's worth noting that these hybrid phishing operations are also capable of bypassing push notifications that use number challenge/number matching as an additional method of verification. Push with number matching/challenge is not phishing-resistant by definition, as a social engineer interacting on the phone with a targeted user can simply request a user to choose or enter a specific number.

By contrast, users that are required to sign in with phishing resistant methods such as Okta FastPass or FIDO passkeys are protected from these attacks.

This is how it's done now

Diallo predicts that we're only at the beginning of a wave of voice-enabled phishing attacks, augmented by tools that provide real-time session orchestration.

"Vishing is becoming such an in-demand area of expertise that, much like access to these kits, that expertise is also sold on an as-a-service basis," Diallo said.

Further, he has observed the real-time session orchestration features of earlier kits being copied into new phishing kits designed exclusively to augment the needs of callers.

Where threat actors could once pay for access to a kit with basic features that targeted all popular Identity Providers (Google, Microsoft Entra, Okta etc) and cryptocurrency platforms, a new generation of fraudsters are attempting to sell access to bespoke panels for each targeted service.

Recommendations

Thankfully there is absolutely no doubt about what defenders need to do.

"In a workplace context, there is no substitute for enforcing phishing resistance for access to resources," said Diallo.

When using Okta for workforce authentication, that would equate to enrolling users in Okta FastPass, passkeys or "both for the sake of redundancy," he said.

Social engineering actors can also be frustrated by setting network zones or tenant access control lists that deny access via the anonymizing services favoured by threat actors.

"The key is to know where your legitimate requests come from, and allowlist those networks," Diallo said.

Some banks and cryptocurrency exchanges are also experimenting with live caller checks - in which a user can sign into a mobile app to find out whether they are on a phone call with an authorized representative at the time.

Okta Threat Intelligence has published threat advisories on voice-enabled phishing campaigns in April 2025 and January 2026 that are available exclusively to the security contacts of Okta customers.

These threat advisories include:

Indicators of Compromise (IoCs)
Analysis of multiple phishing kits
TTPs of intrusion actors conducting these attacks
Detailed control recommendations

To learn more about Okta's approach to phishing resistance, start here.

Jobseekers exploited in fake recruiter phishing campaigns

Daniel L�pez — Fri, 19 Dec 2025 08:00:00 +0000

Resumo Executivo

A Okta Threat Intelligence identificou multiplos clusters de atividade de phishing de alto volume, personificando equipes de recrutamento de varias empresas, usando mais de 400 dominios para facilitar o roubo de credenciais.

Rastreamos essa atividade como O-UNC-038.

Neste relatorio, detalhamos:

Uma campanha usando uma tecnica de "navegador in the navegador" (BitB) para imitar um login social do Facebook, usando bots do Telegram para exfiltracao de credenciais.
Uma campanha direcionada especificamente a credenciais de contas corporativas do Google Workspace, usando Socket.IO para exfiltracao de credenciais
Campanhas de phishing semelhantes com tema de recrutamento

O objetivo principal em todas essas campanhas e a coleta de credenciais.

Embora campanhas mais sofisticadas possam alavancar tecnicas de Adversario-no-Meio (AitM) que capturam cookies de sessao para ignorar a Multi-Factor Authentication (MFA), as campanhas neste aviso conduzem a simples coleta de credenciais por meio de kits de phishing estaticos.

Analise de Ameacas

Varias campanhas, segmentacao semelhante

Descobrimos e rastreamos varias campanhas que usam iscas de phishing com temas de recrutamento semelhantes e abusam dos mesmos servicos para entrega ou rastreamento de iscas.

Em paginas de phishing associadas aos clusters de atividade descritos abaixo, observamos links de rastreamento associados ao Salesforce ExactTarget:

cl.s12[.]exct[.]net/?qs=<UniqueIdentifierString>

Atores de phishing comumente abusam de plataformas de e-mail marketing para enviar e-mails de phishing, seja configurando contas de teste para organizacoes falsas, seja assumindo as contas de clientes da plataforma de e-mail marketing. Os atores de phishing podem entao enviar para grandes listas de e-mail a partir de uma infraestrutura de e-mail confiavel.

A Okta forneceu esses dominios e links de rastreamento para a Salesforce Threat Intelligence, que conseguiu suspender imediatamente as contas da Salesforce associadas e investigar as campanhas.

Abaixo, detalhamos as diferentes iscas e funcionalidades de duas das campanhas.

Analise de Ameacas - Campanha 1

Campanha de credenciais do Facebook de navegador no navegador (BitB) ("Campanha 1")

Este primeiro cluster que analisaremos usa uma tecnica de navegador in the navegador (BitB) para adquirir credenciais do Facebook da vitima, exibindo uma janela de caixa de dialogo de login falsa.

Um ataque BitB e uma tecnica avancada de phishing onde uma pagina da web maliciosa usa HTML, CSS e JavaScript para criar uma janela de navegador falsa dentro da janela real do navegador. Esta janela falsa e projetada para imitar um pop-up legitimo, como o prompt "Login com Facebook", completo com uma barra de endereco falsa e um cadeado de seguranca. Quaisquer credenciais inseridas nesta janela falsa sao capturadas pelo atacante.

Rastreamos 143 dominios associados a esta campanha especifica da tecnica Facebook/BitB. Tambem observamos alguma diversidade no alojamento, possivelmente sugerindo atores separados ou subcampanhas usando a mesma tecnica.

Esta campanha normalmente usa o servico de front-end na nuvem Vercel ou registra nomes de dominio em registrar.eu e hospeda os sites com o Amazon web Services. Esta campanha tambem usa um bot do Telegram para exfiltracao de credenciais e para distribuir atualizacoes para os sites.

Exemplo: Recrutamento Falso da Meta

O exemplo de phishing de credenciais se passa por recrutamento da Meta em tres paginas distintas: uma pagina de destino inicial, um portal de pagina de inscricao de emprego e uma pagina de login falsa do Facebook.

Exemplo: Recrutamento Falso da Puma

A sequencia de tres imagens abaixo e outro exemplo, desta vez se passando pelo recrutamento da Puma:

Iscas de Phishing Observadas - Campanha 1

A campanha BitB utiliza software e servicos corporativos convincentes para enganar os usuarios e leva-los a inserir credenciais. Depois que as credenciais do usuario sao inseridas no site controlado pelo invasor, a pagina de envio simula um processo de travamento.

Analise de Ameacas - Campanha 2

Este cluster nao usa a tecnica de BitB como visto na Campanha 1, mas sim uma pagina de destino estatica que imita uma tela cheia de login de conta do Google.

As paginas de phishing usadas nesta campanha rejeitam formatos de endereco de e-mail pessoal em uma tentativa de capturar credenciais corporativas.

Observamos pelo menos 84 dominios relacionados para esta campanha, que abusa do Cloudflare para ofuscar o endereco IP de origem real e do Socket.IO para exfiltracao de credenciais roubadas.

Exemplo: Recrutamento falso da Sony Playstation

Quaisquer dados enviados no "formulario" abaixo sao ignorados, pois esta campanha apenas tenta capturar credenciais do Google.

Depois que as credenciais sao inseridas, o fluxo de trabalho pode terminar usando um processo de suspensao semelhante ao Cluster 1 ou algum tipo de caixa de dialogo de erro.

Outros Clusters de Phishing com tema de Recrutamento

A nossa investigacao sobre os dois clusters de phishing distintos anteriores descobriu varias campanhas tematicas de recrutamento mais semelhantes, incluindo quase 200 dominios de phishing adicionais.

Estes podem ser agrupados em grupos de combinacoes de infraestrutura e/ou tecnicas de nomenclatura, o que pode sugerir que varios atores independentes podem estar por tras dessas campanhas com temas semelhantes.

Essas campanhas e infraestrutura se passam por varias empresas e servicos de recrutamento conhecidos, incluindo:

Adecco
Adidas
Aquent
Calendly
Calvin Klein
Cisco
CocaCola
Genpact
Givenchy
Google
Hays
Ikea
Inditex
Meta
Playstation (Sony)
Puma
Randstand
Robert Half
Robert Walters
Salesforce
Starbucks
youtube
Zara

Muitos desses dominios de campanha nao usam um host padrao / "www", mas sim nomes de host especificos, como:

aplicar.
hire.
carreiras.
calendly.
caso.
hr.
vagas.
join.
kvn.
recrutar.
recruite.
agendar.
staff.
start.
threads.
xds.

Isso pode reforcar um URL de aparencia valida para a vitima e tambem obscurecer as paginas de phishing no dominio para rastreadores ou pesquisadores que olham apenas para a raiz do dominio.

resposta a ameacas

O que estamos fazendo

Estamos ativamente envolvidos nas seguintes atividades para mitigar esta ameaca:

Monitoramento continuo de novos dominios de phishing registrados e infraestrutura associada a esta campanha.
Fornecer orientacao e assistencia as Organizacoes para melhorar a seguranca dos seus ambientes Okta e investigar qualquer atividade suspeita relacionada com contas potencialmente comprometidas.

Controles de Protecao

Recomendacoes

Habilite o MFA (Autenticacao Multifator) resistente a phishing (FastPass/WebAuthn/chaves de acesso); desabilite SMS/voz para esses usuarios.
Bloqueie e monitore dominios recem-registrados que imitem seu servico. Se o conteudo hospedado no dominio violar direitos autorais ou marcas legais, considere fornecer evidencias e emitir uma solicitacao de remocao junto ao registrador de dominio e/ou provedor de hospedagem web.
Aplique DMARC/DKIM/SPF e alerte sobre e-mails de spoofing de recrutamento/contratacao.
Ensine os usuarios a fazer login apenas em dominios conhecidos (digitar ou adicionar aos favoritos).
Ensine os usuarios a identificar a falsificacao de BitB:
- Se um usuario tentar mover uma janela de login para fora de uma janela do site principal, devera ser capaz de move-la para qualquer lugar na tela do usuario. Uma caixa de dialogo de login falsa e um elemento fixo dentro da pagina host pai - ela so podera se mover dentro dos limites da janela da pagina host.
- Se um usuario minimizar a janela da pagina do host, uma caixa de dialogo de login real permanecera exibida independentemente da janela da pagina do host. Um elemento de login falso sera minimizado em sincronia com a janela da pagina do host.
Aconselhe os candidatos a emprego a utilizarem portais de carreiras oficiais e a rejeitarem solicitacoes ou links para se comunicarem por outras plataformas.
Busque por IoCs (por exemplo, Chamadas de API do bot Telegram, t.me/, bot*getUpdates, sendMessage; Padroes CSS/JS do BitB).

Guia pratico de resposta

Reportar e solicitar a remocao do site malicioso
Redefina as credenciais (senhas, tokens de sessao) dos usuarios impactados e notifique, quando necessario.
Revisar os registros de SSO dos usuarios afetados.
Avalie se deve incluir informacoes sobre ataques "navegador-in-the-navegador" em seu programa de conscientizacao sobre seguranca.

Indicadores de comprometimento

Os contatos de seguranca dos clientes Okta podem fazer login e baixar os Indicadores de Comprometimento de security.okta.com no seguinte link:

https://security.okta.com/product/okta/jobseekers-exploited-in-fake-recruiter-phishing-campaigns

Uma nota sobre a linguagem de estimativa

As equipes do Okta Threat Intelligence usam os seguintes termos para expressar probabilidade, conforme descrito na Diretiva 203 da Comunidade de Inteligencia do Escritorio do Diretor de Inteligencia Nacional dos EUA - Padroes Analiticos.

Probabilidade	Quase sem chance	Muito improvavel	Improvavel	Aproximadamente chance igual	Provavel	Muito provavel	Quase certo(a)
Probabilidade	Remoto	Altamente improvavel	Inverossimil	Aproximadamente probabilidades iguais	Provavel	Altamente Provavel	Quase Certo
Porcentagem	1-5%	5-20%	20-45%	45-55%	55-80%	80-95%	95-99%

Phishing campaigns use 'Employee Benefits' lure to intercept Microsoft and Okta logins

Houssem Eddine Bordjiba — Tue, 21 Oct 2025 07:00:00 +0000

Resumo Executivo

O Okta Threat Intelligence identificou campanhas de phishing de varios estagios que visam Organizacoes que utilizam aplicativos da Microsoft e - onde o acesso a esses aplicativos e federado - o Okta como provedor de identidade (IdP).

Nossas descobertas, primeiramente pesquisando uma campanha distinta que denominamos O-UNC-037, subsequentemente nos levaram a varias outras campanhas usando o mesmo kit de phishing e um tema de atracao muito semelhante. No entanto, a diversidade na infraestrutura e no estilo sugere que, embora estes usem o mesmo kit e tema, e provavel que sejam campanhas separadas executadas por outros agentes de ameacas. Este relatorio se concentra em O-UNC-037, embora compartilhemos detalhes das outras campanhas no apendice no final deste relatorio.

A campanha O-UNC-037 esta ativa desde pelo menos outubro de 2025 e tem como alvo principal organizacoes de tecnologia e fornecimento industrial. Ela entrega e-mails de phishing usando uma isca tematica de beneficios para funcionarios ou recursos humanos (RH) para enganar os usuarios a inserir suas credenciais em uma pagina falsa de login da Microsoft.

A infraestrutura de phishing usa tecnicas de Adversario-no-Meio (AitM) para interceptar fluxos de autenticacao em tempo real, capturando credenciais, codigos de MFA e quaisquer tokens de sessao estabelecidos durante o evento de login. Essa capacidade pode ignorar a protecao de varios metodos comuns de MFA, como codigos SMS e senhas de uso unico (OTP) de aplicativos autenticadores.

Para Organizacoes que usam o Okta para Single Sign-On (SSO), o ataque entao se intensifica para um segundo estagio, redirecionando as vitimas para uma reproducao maliciosa de uma pagina de Login Okta no dominio de phishing do segundo estagio, que atua como um servidor de retransmissao para, adicionalmente, capturar suas credenciais do Okta e roubar o cookie de sessao.

Analise de Ameacas

Esta campanha de phishing usa uma tecnica de ataque de varios estagios. Ela tem como alvo especifico contas Microsoft e lida com o redirecionamento Okta SSO quando encontrado. A cadeia de ataque envolve varias etapas projetadas para direcionar os usuarios visados para uma pagina de coleta de credenciais AitM.

Taticas, Tecnicas e Procedimentos (TTPs) Observados:

Infraestrutura e acesso inicial:
- E-mails de phishing sao entregues com linhas de assunto personalizadas para incluir o nome do usuario e iscas como "Alerta de Beneficios para Funcionarios" ou "mensagem segura do Departamento de RH" para criar uma sensacao de urgencia.
- As campanhas usam dominios de redirecionamento para direcionar usuarios-alvo aos principais sites de phishing, evitando os controles de gateway de e-mail.
- As campanhas exigem que os usuarios resolvam um Cloudflare CAPTCHA antes de apresentar a pagina de phishing.
Execucao e Roubo de Credenciais:
- Usa tecnicas de Adversario-no-Meio (AiTM) capturando credenciais, codigos de MFA e tokens de sessao, interceptando fluxos de autenticacao.
- Implanta um ataque de phishing de varios estagios, primeiro visando credenciais da Microsoft e, em seguida, fazendo o pivot para o Okta SSO se a federacao for detectada.
Kit de Phishing e Atracao:
- Muito provavelmente, utiliza uma plataforma dePhishing-as-a-Service (PhaaS) ou um kit de phishing altamente configuravel, evidenciado por parametros de URL para rastreamento de campanha e carregamento de modelo.
- Usa uma isca de engenharia social generica, mas eficaz, de "Beneficios para Funcionarios".

Iscas de e-mail

O ataque comeca com um e-mail de phishing enviado ao alvo. Com base em suas caracteristicas visuais, essas iscas de e-mail altamente convincentes sao provavelmente geradas usando um modelo de linguagem de grande escala (LLM). Os e-mails usam nomes de remetentes e assuntos projetados para criar uma sensacao de urgencia e legitimidade relacionada a beneficios para funcionarios ou comunicacoes seguras.

Exemplos de cabecalhos de e-mail observados:

De: ADP BENEFITS <notifications[@]duobenefits[.]com>
Assunto: [Nome do Usuario]! Alerta de Beneficios para Funcionarios - Novas Alteracoes em Vigor Agora

De: Secure Mail <noreply[@]mailsafe365[.]com>
Assunto: [Nome do Usuario]! Voce recebeu uma mensagem segura do Departamento de RH

Tambem observamos exemplos do que parece ser abuso da plataforma de marketing por e-mail de terceiros de uma organizacao genuina, possivelmente por meio de uma conta comprometida:

De: ADP Benefits <notifications_adp_com[@]emails[.]t??????s[.]Organizacao>
Assunto: Confidencial: [Nome do Usuario]! Seu Pacote de Beneficios Foi Atualizado

Links iniciais de redirecionamento em e-mails

Os usuarios sao direcionados primeiramente para a infraestrutura de phishing por meio de links de redirecionamento iniciais dentro dos e-mails. A maioria deles sao dominios recem-registrados de primeira parte, evitando problemas de reputacao historicos para contornar as medidas de seguranca de e-mail:

benefits-alerts[.]com
benefitsapp001[.]com
qrcodelnk[.]com
302lnk[.]com
goto365[.]link
fastlink247[.]link
link24x7[.]link
fast2url[.]link
url247[.]link

Tambem notamos um exemplo de link de redirecionamento abusando da conta legitima de uma organizacao em um servico de marketing por e-mail de terceiros para redirecionamento:

t??????s[.]msg???[.]com

Um exemplo de link de redirecionamento usa o site comprometido de uma organizacao genuina:

Marketing.s??????y[.].com

Usar contas de servico de e-mail marketing comprometidas ou websites genuinos comprometidos e uma medida eficaz para alcancar maior entregabilidade durante campanhas de phishing.

A camada de redirecionamento tambem oferece ao agente de ameacas a capacidade de substituir paginas de phishing de substituicao, caso alguma pagina de segundo estagio seja desativada.

Desafio de seguranca

Apos o redirecionamento para o site de phishing principal, o usuario e primeiramente apresentado a uma pagina intitulada "Verificacao de Seguranca", empregando um CAPTCHA genuino do Cloudflare. Esta etapa foi projetada para aparentar legitimidade e atua como um "porteiro" para evitar a analise automatizada do site de phishing.

Pagina inicial

Depois que o desafio CAPTCHA e concluido, o site exibe brevemente uma tela inicial com o tema adequado a isca mencionada.

Coleta de credenciais

Apos a tela inicial, um usuario-alvo e presenteado com a pagina de phishing de primeiro estagio, que se passa por um login da Microsoft e usa o ataque man-in-the-middle (AitM) para roubar credenciais de usuario e, se o usuario se autenticar com sucesso, todos os tokens resultantes.

Redirecionamento de segundo estagio para login Okta

Se o dominio de e-mail da vitima indicar que sua organizacao usa Okta para federacao de identidade, o script do site de phishing intercepta o fluxo de autenticacao legitimo. Ele substitui dinamicamente o URL de redirecionamento Okta legitimo por um malicioso (por exemplo, sso[.]oktacloud[.]io), enviando o usuario para uma pagina de phishing Okta semelhante para usar novamente o AitM para coletar suas credenciais SSO e roubar o cookie de sessao resultante. Detalamos essa tecnica em nossa analise de codigo, mais adiante neste relatorio.

Infraestrutura de campanha original

Nossa analise da campanha O-UNC-037 identificou a seguinte infraestrutura usada para hospedar as paginas falsas e maliciosas de login da Microsoft:

benefitsemployeeaccess[.]com
benefitsquickaccess[.]com
benefitsworkspace[.]com
benefitscentralportal[.]com
benefitsselfservice[.]com
benefitsmemberportal[.]com
benefitsgatewayportal[.]com
benefitshubportal[.]com
benefitsadminportal[.]com
benefitsaccessportal[.]com
benefitsviewportal[.]com

Os sites de phishing usam varios caminhos de URL para promover ainda mais a isca de "beneficios para funcionarios":

/benefits/login/
/compensation/auth/
/rewards/verify/
/employee/access/

Os usuarios federados sao redirecionados para as seguintes paginas de destino de segundo estagio apos fornecer as credenciais primarias para sua conta Microsoft.

sso[.]oktacloud[.]io
sso[.]okta-access[.]com
Internal-networks[.]com

A analise dos dominios de phishing de redirecionamento com segmentacao Okta nos levou a varias instancias usando Cloudflare Workers, que e uma plataforma sem servidor frequentemente utilizada por agentes de ameacas para hospedar e servir sites de phishing.

sso[.]okta-proxy[.]workers[.]dev
okta[.]undermine[.]workers[.]dev
oktapage[.]oktamain[.]workers[.]dev
okta[.]eventspecial[.]workers[.]dev

Infraestrutura de campanhas adicionais

Partindo da campanha de phishing O-UNC-037, descobrimos outras campanhas que utilizavam o mesmo kit de phishing e iscas muito semelhantes. A observacao dos detalhes da infraestrutura nesses outros exemplos sugere que e provavel que sejam operados independentemente por outros agentes maliciosos, possivelmente seguindo as instrucoes de um "metodo" compartilhado ou vendido. Incluimos uma lista desses dominios, juntamente com os dominios O-UNC-037, nos Indicadores de Compromisso, cujo link se encontra no final deste documento.

Analise de pagina de phishing

Esta campanha segue uma cadeia de ataque estruturada que combina engenharia social e tecnicas AitM capazes de roubar tokens de sessao do Microsoft 365 ou Okta. A analise dos URLs e paginas de phishing sugere que o ator esta usando um Phishing-as-a-Service (PhaaS) ou um kit de phishing altamente configuravel.

Uma analise detalhada dos URLs de phishing revela um mecanismo de controle embutido em seus parametros de consulta, particularmente no parametro "ht", que contem um objeto JSON codificado em Base64.

https://benefitsemployeeaccess[.]com/rewards/verify/d582500e?s=3&ht=eyJpZCI6IjY2ZmI2OWMwNjA2N2RjOTM5Yzc5OTM1NWE0ODNjNzM3IiwidHlwZSI6ImhvcCIsImNhbXBhaWduX2lkIjoiY2FtcF82OGYyNjQ3YTlmYjE0IiwiaG9wX3RlbXBsYXRlIjoiYmVuZWZpdHMiLCJzdWNjZXNzX3RlbXBsYXRlIjoiYmVuZWZpdHNfZXJyb3IiLCJjcmVhdGVkIjoxNzYwOTM3NDcyLCJleHBpcmVzIjoxNzYwOTQ0NjcyLCJpcCI6IjExMy4yOS4yNDMuMSIsIm1heF91c2VzIjoxMDAwMDAwMCwidXNlcyI6MCwiaG9wX2NvdW50IjozLCJzZXNzaW9uIjoiZG9oNnBhbnE0Y3RhZTVsMjhvNWoyaTdoa3YifQ%3D%3D.bb0c9db57db67ff678edafb64f3cdc4fccfa93d4a8952e05ca2a3176e8134db5

Quando decodificado, esse objeto revela um conjunto abrangente de pontos de dados para rastreamento e controle de acesso. Contem informacoes detalhadas de rastreamento, incluindo um "campaign_id", um "hop_template" para carregamento dinamico de conteudo, o endereco "ip" da vitima e um ID de "session" exclusivo. Simultaneamente, inclui os termos de acesso por meio de registros de data e hora de criacao e expiracao de links ("criado", "expira") e contadores de uso ("usos", "usos_maximos"). Essa estrutura de dupla finalidade indica um sistema de backend que nao apenas funciona como um controlador para impor acesso estrito e com tempo limitado, mas tambem permite ao invasor rastrear campanhas individuais, carregar dinamicamente diferentes modelos de phishing e monitorar as interacoes com as vitimas. Essa capacidade permite ao agente adaptar facilmente suas iscas e alvos sem precisar reimplantar toda a infraestrutura.

  "id": "66fb69c06067dc939c799355a483c737",

  "type": "hop",

  "campaign_id": "camp_68f2647a9fb14",

  "hop_template": "benefits",

    "success_template": "benefits_error",

  "created": 1760973582,

  "expires": 1760980782,

  "ip": "?????",

  "max_uses": 10000000,

  "uses": 0,

  "hop_count": 3,

  "session": "qa061c1uiht26gmtqcj49fsgci"

A analise da pagina inicial de phishing da Microsoft mostra o tratamento dado aos usuarios de organizacoes federadas pela Okta. Quando um usuario desse tipo insere seu e-mail, um portal de login legitimo do O365 normalmente retorna uma resposta JSON contendo um FederationRedirectUrl que aponta para o tenant Okta da empresa.

A campanha usa JavaScript na pagina de phishing para interceptar este processo. O script esta configurado para:

Monitore as respostas de fetch do servidor.
Inspecione as respostas JSON em busca de chaves como FederationRedirectUrl, AuthURL ou RedirectUrl.
Verifique se o URL aponta para um tenant Okta legitimo (.okta.com, .oktapreview.com, etc.).
Se uma URL Okta legitima for encontrada, o script a substitui dinamicamente por uma URL que aponta para o dominio de phishing malicioso de segundo estagio do ator, por exemplo: sso[.]oktacloud[.].io.
A resposta modificada e entao repassada ao navegador, redirecionando perfeitamente o usuario para a pagina de login falsa do Okta do ator.
As credenciais capturadas e os cookies de sessao sao exfiltrados para um endpoint de API no servidor de phishing.
O script inclui funcoes para preencher automaticamente o nome de usuario do hash da URL e clicar automaticamente nos botoes "Next" e "Stay signed in", criando uma experiencia mais perfeita e menos suspeita para a vitima.

Essa interceptacao AitM permite que o agente sequestre o fluxo de autenticacao em tempo real, apresentando ao usuario uma replica da pagina de login do Okta para capturar as credenciais de Single Sign-On (SSO) e o cookie de sessao estabelecido.

     var _wd = "https://sso.oktacloud.io";

        var _iO = function (u) {

            if (typeof u !== "string") return false;

            if (u.includes("sso.oktacloud.io")) return false;

            if (u.includes("/app/office365")) return true;

            if (u.match(/\.(okta|oktapreview|okta-emea)\.com/i)) return true;

            if (u.match(/\/sso\/saml|\/sso\/wsfed|\/app\/[^\/]+\/sso/i)) return true;

            return false;

};

Tentativas subsequentes de roubo da conta

Apos o comprometimento bem-sucedido de credenciais e roubo de token de sessao, os agentes de ameacas foram observados tentando e autenticando com sucesso a partir de IPs CloudFlare (AS13335).

resposta a ameacas

O que estamos fazendo

Estamos ativamente envolvidos nas seguintes atividades para mitigar esta ameaca:

Monitoramento continuo de dominios de phishing e infraestrutura recem-registrados associados a esta campanha.
Apresentar proativamente relat rios de abuso aos registradores e provedores de hospedagem relevantes para iniciar solicita es de remo o para sites maliciosos identificados.
Fornecer orientacao e assistencia as organizacoes para aprimorar a seguranca de seus ambientes Okta e investigar qualquer atividade suspeita relacionada a contas potencialmente comprometidas.

Controles Protetores

Recomendacoes para clientes

Incentive os usuarios a se registrarem em autenticadores fortes, como Okta FastPass, FIDO2 WebAuthn e cartoes inteligentes, e aplique a resistencia ao phishing na politica.
As politicas de acesso de aplicativos Okta (anteriormente "politicas de autenticacao") tambem podem ser usadas para restringir o acesso a contas de usuario com base em uma variedade de pre-requisitos configuraveis pelo cliente. Recomendamos que os administradores restrinjam o acesso a aplicativos confidenciais a dispositivos que sao gerenciados por ferramentas de Gerenciamento de Endpoint e protegidos por ferramentas de seguranca de endpoint. Para acesso a aplicativos menos confidenciais, exija dispositivos registrados (usando Okta FastPass) que exibam indicadores de higiene essencial.
Negue ou exija maior seguranca para solicitacoes de redes raramente usadas. Com o Okta Network Zones, o acesso pode ser controlado por local, ASN (Numero do Sistema Autonomo), IP e Tipo de IP (que pode identificar proxies de anonimato conhecidos).
As avaliacoes de Comportamento e Risco do Okta podem ser usadas para identificar solicitacoes de acesso a aplicativos que se desviam dos padroes de atividade do usuario estabelecidos anteriormente. As politicas podem ser configuradas para aumento de nivel ou negar solicitacoes usando este contexto.
Treine os usuarios para identificar indicadores de e-mails suspeitos, sites de phishing e tecnicas comuns de engenharia social usadas por invasores. Facilite para os usuarios relatarem problemas potenciais configurando Notificacoes para o Usuario Final e Relatorios de Atividade Suspeita.
Documente, divulgue e siga um processo padronizado para validar a identidade de usuarios remotos que entram em contato com o pessoal de suporte de TI e vice-versa.
Adote uma abordagem de "Zero privilegios permanentes" para acesso administrativo. Atribua aos administradores Funcoes de Administrador Personalizadas com as menores permissoes necessarias para as tarefas diarias e exija autorizacao dupla para acesso JIT (just-in-time) a funcoes mais privilegiadas.
Aplique o IP Session Binding a todos os aplicativos administrativos para impedir a reproducao de sessoes administrativas roubadas.
Ative as Acoes Protegidas para forcar a reautenticacao sempre que um usuario administrativo tentar executar acoes confidenciais.

Observando e respondendo a infraestrutura de phishing:

Analise os registros de aplicativos (registros Okta, web proxies, sistemas de e-mail, servidores DNS, firewalls) em busca de qualquer evidencia de comunicacao com dominios suspeitos.
Monitore os dominios regularmente para ver se o conteudo muda.

Se o conteudo hospedado no dominio violar direitos autorais ou marcas legais, considere fornecer evidencias e emitir uma solicitacao de remocao ao registrador de dominio e/ou provedor de hospedagem na web.

Indicadores de Comprometimento

Os contatos de seguranca dos clientes da Okta podem fazer login e baixar os Indicadores de Comprometimento como um arquivo CSV em security.okta.com no seguinte link:

https://security.okta.com/product/okta/phishing-campaigns-use-employee-benefits-lure-to-intercept-microsoft-and-okta-logins

Uma nota sobre a linguagem de estimativa

As equipes de Okta Threat Intelligence usam os seguintes termos para expressar a probabilidade, conforme descrito na Diretiva 203 da Comunidade de Inteligencia do Gabinete do Diretor de Inteligencia Nacional dos EUA - Padroes Analiticos.

Probabilidade	Quase sem chance	Muito improvavel	Improvavel	Aproximadamente chance igual	Provavel	Muito provavel	Quase certo(a)
Probabilidade	Remoto	Altamente improvavel	Improbable	Aproximadamente mesmas chances	Provavel	Altamente Provavel	Quase Certeza
Porcentagem	1-5%	5-20%	20-45%	45-55%	55-80%	80-95%	95-99%

Wide-scale, opportunistic SMS pumping attacks target customer sign-up pages

Grayson Schermerhorn, Mathew Woodyard — Tue, 14 Oct 2025 07:00:00 +0000

Executive Summary

Okta Threat Intelligence has identified a cluster of shared disposable email infrastructure and commodity proxy services, internally designated as O-UNC-036, that is being used to launch high-volume, automated attempts against public API endpoints.

This infrastructure has been observed in multiple persistent, large scale and financially motivated SMS pumping campaigns starting at least as early as July 2025.

To execute this attack, threat actors undertake the following sequence of actions:

Create a new account using a disposable email address, often tied to a set of domains
Add an actor-controlled phone number as an authentication factor
Send as many messages to the number as possible in order to achieve their monetary objectives

These attacks generate significant financial costs for the target organizations by running up bills with their telephony providers. We have been able to track historical activity from this cluster of disposable email domains back to at least March 2024, indicating a sustained, adaptive effort. Due to the high financial risk and potential for service degradation, we strongly recommend the immediate implementation of the protective controls, monitoring and aggressive response outlined in this report.

Threat Analysis

The primary objective of this campaign is opportunistic, large-scale account creation in order to carry out SMS pumping campaigns. In these attacks, threat actors profit by collaborating with high-cost international or premium-rate SMS providers. By exploiting the SMS delivery system of the target identity platform, the attacker triggers messages to phone numbers they control in high-cost regions. The victim organization is then billed for the exorbitant volume and cost of these international or premium SMS messages, with the cost of attacks potentially costing hundreds of thousands of dollars in telephony bills.

The attack follows a high-volume pattern:

Reconnaissance and Enumeration: Attackers identify multi-factor authentication (MFA) or user registration endpoints that trigger an SMS code.
Infrastructure Setup: Actors use commodity proxy services (VPNs, anonymizing proxies, residential botnets etc.) to distribute the source IP addresses of the traffic, reducing the efficacy of rate-limiting based solely on IP.
High-Volume Requests: Automated scripts submit requests using known, high-cost phone country codes and rapidly generated, disposable email addresses.
Cluster Activity: The O-UNC-036 infrastructure is a key enabler. This cluster utilizes a revolving pool of shared disposable email domains to bypass email-based rate limits and tenant-level velocity checks, allowing them to rapidly cycle through accounts for message requests. Okta Threat Intelligence has tracked activity in this cluster back to at least March 2024.
Target Scope: We observed this activity in multiple tenants and organizations of both Auth0 and OCI, indicating a widespread, indiscriminate search for vulnerable endpoints that trigger SMS delivery. The same shared infrastructure is likely also used to attack organizations building their own customer sign-in pages or using alternative services.

For technical details of how to identify these attacks in your logs, see the Detection and Indicators sections of this report.

Detection

Our research has not uncovered any legitimate use of emails under domains listed in the indicators section of this report. Thus the existence of users with such emails is sufficient to detect attacks. Given the potential duration of this attack, it is critical that administrators look back as far as possible in their logs to determine the scope of past and future impact.

Okta Customer Identity

High numbers of messages being sent to countries outside of your company's normal operating regions.
A spike in the following event types:

        system.sms.send_okta_push_verify_message

        system.sms.send_factor_verify_message where result=DENY

and

        reason=Toll Fraud Suspected

A spike in the following event type:

        system.email.new_device_notification.sent_message

as malicious account's alternative proxy providers or ASNs every login.

See the "Monitoring of your Okta org" section of our support article "How to Mitigate Toll Fraud when Using Okta for Voice Authentication" for a comprehensive overview of detection strategies.

Auth0

ss events from the domains listed in the Indicators of Compromise section. Administrators should refer to detection rules provided in the FOSS Auth0 Security Detection Catalog and modify them as needed.
Spikes in Guardian events, especially gd_enrollment_complete and gd_send_sms events. We advise administrators to use the risk_of_signup_fraud_by_volume.yml and sms_bombarding.yml detection rules in the Auth0 Security Detection Catalog.
A spike in "MFA bypass" events in Security Center.
High numbers of messages being sent to countries outside of your company's normal operating regions.

Protective controls and response

Okta Threat Intelligence has observed these attackers abandon a target when frustrated by the introduction of controls. This makes aggressive response and implementation of proper controls effective in stopping these attacks.

While ever sending SMS messages costs money, attackers will find a way to skim off the top. This risk can only be fully mitigated by migrating to another authentication factor. We strongly recommend the adoption of FIDO Authentication (passkeys).
Our research has not uncovered legitimate use of the domains provided in the Identicators section of this document. Deactivate users that provided these emails after making your own assessment.
Accounts created from the ASNs in the Indicators section of this document are seldom legitimate. Administrators are advised to deactivate these accounts unless friction is a major concern.
Disable sending messages to untrusted countries in your telephony provider.

Okta Customer Identity

Implement FIDO Authentication with WebAuthn and migrate users' factors away from SMS.
Use passkeys instead of SMS or voice factors.
Enable bot protection for enforcement. We recommend setting a Bot Likeliness threshold of Low and above or Always on Sign-up and Sign-in flows when you are under attack.
Block anonymizers and proxies at edge by leveraging enhanced dynamic network zones.
Utilizing workflows to manage self-service registration users from malicious domains. An Okta Identity Defense generated workflow exists that can be utilized or expanded upon and can be found here.
Utilize the Okta API to quickly deactivate large batches of identified users.
Leverage identity proofing integrations.
See our support article "How to Mitigate Toll Fraud when Using Okta for Voice Authentication" for a comprehensive overview of responses and preventative controls.
Block suspicious activity using the tooling provided by your telephony provider.

Contact Okta Support to provide a list of allowed telephony countries if you're confident in the specific list of countries servicing your customers. You can also request to modify the rate limits on your organization.

Auth0

Implement FIDO Authentication with Webauthn and migrate users' factors away from SMS or voice factors.
Use passkeys instead of SMS or voice factors.
Block requests from the ASes and TLS client fingerprints in the Indicators of Compromise section at edge with Auth0's Tenant Access Control List feature.
Since these attackers are especially sensitive to friction, enabling bot detection and enforcing CAPTCHA can be an effective control.
Block users from registering using the email domains listed in the
Indicators of Compromise section with Signup and Login triggers.
Disable sending messages to untrusted countries in your telephony provider.
Lower your rate limits to lower the number of accounts attackers can create using the same IP address.
Consider identity proofing integrations like those available in the Auth0 marketplace.
If you identify a large number of fraudulent users, engage Auth0 support for assistance.

Grayson Schermerhorn and Mathew Woodyard contributed to this research.

Appendix A: Indicators

This is an ongoing investigation, and additional Indicators may be identified as the campaign evolves. Organizations are advised to remain vigilant and implement the recommended mitigation strategies.

Domain
2mails1box.com 300bucks.net blueink.top desumail.com e-boss.xyz e-mail.lol echat.rest electroletter.space emailclub.net energymail.org gogomail.ink gopostal.top guesswho.click homingpigeon.org kakdela.net letters.monster lostspaceship.net	message.rest myhyperspace.org mypost.lol postalbro.com protonbox.pro rocketpost.org sendme.digital shroudedhills.com specialmail.online ultramail.pro whyusoserious.org wirelicker.com writeme.live writemeplz.net

Domain

2mails1box.com
300bucks.net
blueink.top
desumail.com
e-boss.xyz
e-mail.lol
echat.rest
electroletter.space
emailclub.net
energymail.org
gogomail.ink
gopostal.top
guesswho.click
homingpigeon.org
kakdela.net
letters.monster
lostspaceship.net

message.rest
myhyperspace.org
mypost.lol
postalbro.com
protonbox.pro
rocketpost.org
sendme.digital
shroudedhills.com
specialmail.online
ultramail.pro
whyusoserious.org
wirelicker.com
writeme.live
writemeplz.net

Autonomous Systems Number (ASN)
212238 16276 44477 26548 200373 137409 214483 13213 397368

TLS Client JA4 Fingerprints are also available from an unredacted advisory that Okta customers can download at security.okta.com.

The s1ngularity attack: When attackers prompt your AI agents to do their bidding

Brett Winterford — Sun, 05 Oct 2025 22:00:00 +0000

Em meados de setembro, um incidente na cadeia de suprimentos de software - comumente chamado de "ataque s1ngularity" - marcou um ponto de virada no uso de Inteligencia Artificial por adversarios.

Embora o vetor de acesso inicial fosse familiar - um ataque de phishing direcionado a mantenedores de pacotes npm -, o malware resultante era inedito. Este e um dos primeiros ataques em que agentes de IA locais foram usados como arma para auxiliar no roubo de credenciais.

Esta tecnica representa uma escalada ameacadora na engenhosidade do invasor, indo alem de simples scripts personalizados para alavancar os recursos de resolucao de problemas das ferramentas de IA ja disponiveis na maquina de um alvo.

Eu me sentei com Paul McCarty, chefe de pesquisa da Safety Cybersecurity - que recentemente publicou uma analise detalhada do ataque - para discutir suas descobertas, incluindo os prompts de IA usados para procurar segredos e burlar as protecoes, e como essa ameaca poderia evoluir no futuro. Assista ao video acima ou continue lendo para ter uma visao geral do que conversamos.

A anatomia de um ataque pos-instalacao

Durante o ataque, atualizacoes maliciosas foram enviadas para pacotes npm populares, incluindo nx, o que resultou no roubo de milhares de credenciais de desenvolvedores. Um componente-chave do malware era um script pos-instalacao que o invasor chamou de telemetry.js.

A principal funcao deste script era ser executado imediatamente apos a instalacao e procurar no host comprometido por arquivos confidenciais e segredos. Crucialmente, o invasor introduziu um novo metodo de descoberta, verificando a presenca de agentes CLI locais para modelos de linguagem de grande escala (LLMs) populares - especificamente Claude, Gemini e AWS Q.

McCarty descreve isso como uma clara evolucao da abordagem de "viver da terra", onde os invasores abusam de ferramentas confiaveis pre-instaladas. Os desenvolvedores geralmente tem esses agentes de CLI instalados para agilizar os fluxos de trabalho de codificacao, tornando-os um alvo de alto valor e prontamente disponivel para um invasor.

Vivendo de prompts locais

O script malicioso telemetry.js nao apenas procurava passivamente por arquivos; ele usava agentes de IA para fazer o trabalho pesado por meio de um prompt.

Verificacao inicial: O script detectaria se um agente de IA suportado (app CLI) foi instalado e em qual plataforma (o malware visava principalmente hosts Linux e macOS).
O prompt: O malware entao executava um prompt especialmente elaborado por meio do agente instalado. O objetivo principal do prompt era a enumeracao de arquivos: pedir a IA para pesquisar recursivamente o sistema de arquivos do host e gerar uma matriz abrangente de arquivos que poderiam conter segredos.
Segredos Alvo: Esta nao foi uma busca cega. O prompt focava em "arquivos suculentos", como .env e .config arquivos, que normalmente conteriam segredos, como:
- Tokens do GitHub e npm
- Credenciais da plataforma de nuvem (por exemplo, tokens da AWS)
- Chaves SSH

O papel do agente de IA era usar os vastos dados de treinamento do LLM e o conhecimento contextual do ambiente do alvo para determinar os melhores locais para pesquisar. O agente de IA forneceu efetivamente ao invasor uma ferramenta de descoberta que poderia se adaptar dinamicamente ao ambiente do alvo.

Os agentes de IA sao imprevisiveis, mas confiaveis o suficiente em escala

A analise da carga maliciosa feita por McCarty revelou uma visao fascinante do processo de pensamento do invasor. Varias atualizacoes sucessivas nos pacotes envenenados revelam pelo menos quatro versoes diferentes do prompt de IA.

Essa rapida iteracao foi uma batalha ativa contra o nao determinismo e as protecoes inerentes aos aplicativos de IA. O invasor teve que experimentar continuamente para encontrar o prompt perfeito que:

Ignorar protecoes: Evitar as salvaguardas integradas do agente que rejeitam solicitacoes maliciosas obvias ou solicitacoes para acessar recursos do sistema de arquivos
Maximize os resultados: Gere a lista mais abrangente de caminhos de arquivos confidenciais
Otimize a velocidade: Reduza o foco para excluir arquivos de codigo-fonte comuns, acelerando o processo geral de coleta de dados

Esse processo iterativo demonstra uma das deficiencias das ferramentas de IA: os usuarios geralmente precisam fazer a mesma pergunta varias vezes, de maneiras diferentes, para se aproximarem de um resultado bem-sucedido. Tambem destaca um risco crescente para os defensores: nao ha garantias de que os agentes de IA aderirao aos guardrails. Como o proprio teste de McCarty mostrou, os agentes de IA as vezes "ignoravam os guardrails e simplesmente entravam no modo YOLO".

Este incidente confirma que a IA agentica representa uma superficie de ataque nova e significativa. Quando conectados a estacoes de trabalho de Developers, eles podem ser transformados em um mecanismo poderoso de descoberta para a coleta de credenciais e outras informacoes confidenciais.

Leitura recomendada

Para uma analise tecnica aprofundada das quatro versoes de prompts de IA maliciosos e suas diferentes taxas de sucesso contra Claude e Gemini, recomendamos fortemente a leitura da analise completa de Paul McCarty e da equipe de Seguranca: Analysing the AI used in the NX Attack.

EvilProxy phishing campaign leverages convincing impersonations of enterprise applications

Daniel L�pez — Tue, 30 Sep 2025 07:00:00 +0000

Resumo Executivo

A Okta Threat Intelligence identificou uma campanha de ataque de alto volume que, segundo pesquisas subsequentes, esta ativa desde pelo menos marco de 2025, utilizando o kit de ferramentas EvilProxy de phishing-as-a-service (PhaaS) para executar ataques de phishing em tempo real projetados para roubar credenciais de usuarios e cookies de sessao ativos. Rastreamos esta campanha como O-UNC-035.

Esta operacao tem como alvo organizacoes em varios setores, incluindo financas, governo, saude e tecnologia, usando principalmente iscas altamente convincentes que se passam por ferramentas de negocios populares, como SAP Concur, e servicos de assinatura de documentos, como Adobe ou DocuSign.

Analise de Ameacas

EvilProxy Phishing-as-a-Service

EvilProxy (O-TA-041) e um kit de ferramentas PhaaS que usa uma arquitetura de proxy reverso/adversario-no-meio (AitM) para interceptar logins e cookies de sessao das vitimas em tempo real, permitindo que os invasores burlem a autenticacao multifator (MFA) e sequestrem contas.

Originalmente observado em 2022 e rapidamente transformado em produto nos mercados da dark web, o EvilProxy tem sido amplamente utilizado em campanhas direcionadas de roubo da conta e Business e-mail comprometimento porque ele faz o proxy de sites legitimos. Isso significa que os usuarios veem prompts de MFA reais e que o invasor e capaz de capturar tokens e cookies para que o invasor possa reproduzir. Como o EvilProxy e vendido e mantido como um servico, ele dimensiona ataques e diminui a barreira de habilidades para criminosos: os operadores podem iniciar grandes volumes de campanhas de phishing personalizadas.

Mecanismos de atracao

Observamos softwares e servicos Enterprise confiaveis sendo personificados para enganar os usuarios a clicar em links e inserir credenciais:

Servicos de assinatura de documentos (como Docusign, Adobe Acrobat, Adobe Sign, EchoSign): Um tema recorrente observado nesta campanha foi a personificacao de provedores de gerenciamento de documentos e assinatura eletronica. Os invasores utilizam a promessa de um documento compartilhado ou uma solicitacao de assinatura para atrair as vitimas.
Plataformas de despesas e aquisicao (como SAP Concur, Coupa): Esta foi a isca mais frequente observada nesta campanha. Ela tem como alvo funcionarios, personificando sistemas populares de gerenciamento de despesas e viagens, geralmente com prompts para aprovar um relatorio ou revisar uma despesa. Uma isca mais generica usa termos como expense, expensereport ou expensesolutions.
Microsoft SharePoint: A campanha tambem tem como alvo usuarios do ecossistema Microsoft 365, simulando um link para um documento compartilhado ou um site colaborativo.
Reunioes Online: Os invasores registraram dominios genericos que incluem palavras como "reuniao" para se passar por convites para plataformas de reuniao.
KnowBe4: Os invasores se passaram por uma empresa de treinamento de conscientizacao de seguranca, em uma tentativa de induzir os usuarios visados a presumir que a isca de phishing fazia parte de um teste de phishing oficial.

Analise de codigo

A cadeia de redirecionamento da isca comeca com um link curto, no qual o endereco de e-mail da vitima e ofuscado dentro do caminho do URL. O usuario e entao redirecionado por meio de um redirecionador com a marca da empresa-alvo no subdominio e, finalmente, chega a uma pagina de phishing convincente com a marca Microsoft que rouba credenciais. O JavaScript no redirecionador extrai o e-mail do caminho, recodifica-o e cria um URL de redirecionamento personalizado que carrega essa identidade em cada salto.

Exemplo 1 de cadeia HTTP

Link Inicial:

hxxps[://]expensereport[.]ch/[coded_string]

Redirecionador:

hxxps[://][company][.]sapconcur[.]sa[.]com/expense/?uid=[uid]&hid=[hid]
&document=[document]&token=[token]&t=[t]

URL final (mostrando o site de login para a coleta de credenciais):

hxxps[://][32_characters_string][.]laurimarierefling[.]com/?uid=[uid]&hid=[hid]
&document=[document]&token=[token]&t=[token]&[string_7_characters]=[string_32_characters]

Exemplo 2 de cadeia HTTP

Link Inicial:

hxxps[://]sapconcursolutions[.]pl/[coded_string]

Redirecionador:

hxxps[://][company][.]sapconcur[.]sa[.]com/expense/?uid=[uid]&hid=[hid]
&document=[document]&token=[token]&t=[t]

URL final (mostrando o site de login para coleta de credenciais):

hxxps[://][32_characters_string][.]concurmgt[.]pl//?uid=[uid]&hid=[hid]
&document=[document]&token=[token]&t=[token]&[string_7_characters]=[string_32_characters]

Como o redirecionador decodifica e personaliza a vitima

As paginas de phishing aceitam o ultimo segmento de caminho e tentam o uso de varios decodificadores em sequencia - mapeamento de token personalizado, hex, Base32 e Base64 - ate que o resultado contenha "@". Esse valor se torna o e-mail da vitima para uso downstream, como visto neste exemplo de codigo de pagina de isca inicial:

let encodedValue = window.location.pathname.split('/').pop();
...
e-mail = decodeEmail(encodedValue); // custom tri-gram map
...
if (!decodingSuccessful && isHexadecimal(encodedValue)) e-mail = hexToString(encodedValue);
if (!decodingSuccessful && isBase32(encodedValue)) e-mail = base32ToString(encodedValue);
if (!decodingSuccessful && isBase64(encodedValue)) e-mail = base64ToString(encodedValue);

O decodificador personalizado substitui tokens de tres caracteres de volta em caracteres, usando um mapa como:

const encodingMap = {
    "@":"MN3",".":"OP4","a":"QR5","e":"ST6","i":"UV7",
    "o":"WX8","u":"YZ9","s":"ABO","n":"CD1","r":"EF2",
    "d":"GH3","I":"JK4"
};

Portoes anti-analise

Antes de redirecionar, o script tenta evitar rastreadores e sandboxes:

function isBot() {
    const botPatterns = ['bot','spider','crawl','slurp','baidu','yandex',
        'wget','curl','lighthouse','pagespeed','prerender','screaming frog',
        'semrush','ahrefs','duckduckgo'];
if (navigator.webdriver || navigator.plugins.length === 0 ||
    navigator.languages === "" || navigator.languages === undefined)
return true;
...
}

Se um sinal de bot/headless for encontrado - ou se a organizacao "bloqueada" do operador aparecer - a pagina redireciona diretamente para o login legitimo da Microsoft, dando as equipes de triagem uma pagina limpa enquanto os usuarios reais continuam no phish. O servico api.ipify.org e usado para retornar o endereco IP publico da vitima, para comparar com uma lista de bloqueio de IP/faixa.

Dominios bloqueados

O codigo tambem contem dois dominios bloqueados que, se encontrados no endereco de e-mail da vitima, farao com que o fluxo de phishing saia em vez de ir para a pagina de login autentica da Microsoft:

const blockedDomains = ['belfius', 'baringa'];
const emailDomain = email.split('@')[1].toLowerCase();

for (const blocked of blockedDomains) {
    if (emailDomain.startsWith(blocked)) {
        window.location.href = "https://login.microsoftonline.com/common/login";
return;
    }
}

A proveniencia do bloqueio desses dois dominios e desconhecida. O dominio "belfius" parece se referir a um banco belga, enquanto "baringa" parece estar associado a uma consultoria de gestao do Reino Unido.

Parametros de consulta

Em todas as amostras observadas, o redirecionador cria o mesmo URL parametrizado e apenas a familia de dominio varia. Dois parametros sao o e-mail da vitima em diferentes involucros; o restante sao nonces mais um timestamp:

uid ? Base64(e-mail)
- Pode ser decodificado usando uma receitado CyberChef
hid ? hex(Base64(e-mail))
- Pode ser decodificado usando uma receitado CyberChef
document, token ? IDs aleatorios (semelhantes a nonce)
t ? Unix timestamp (ms)
- Pode ser convertido para uma data legivel usando a receitado CyberChef

fluxo de autenticacao

Dentro do fluxo de autenticacao, o nome da empresa personificada aparece em certos campos do redirecionador e do URL final. Alem disso, a estrutura de phishing preenche automaticamente o endereco de e-mail da vitima no campo de nome de usuario da pagina de phishing.

Link inicial:

hxxps[://]expensereport[.]ch/616c6578616e6465722e652e6261754073662e6672622e6f7267

Redirecionador:

hxxps[://]sf[.]sapconcur[.]sa[.]com/expense/?uid=...&hid=...&document=...&token=...&t=...

URL Final

hxxps[://]299afcb76fac4238a0facad80c326230[.]concursolutions[.]asia/?uid=...&hid=...
&document=...&token=...&t=...&u9pPUdqL=...

Link inicial:

hxxps[://]concursecure[.]pl/AB0ST6QR5CD1OP4kUV7CD1CD1MN3cST6CD1AB0YZ9AB0OP4gWX8v

Redirecionador:

hxxps[://]census[.]concursystem[.]cv/auth/?uid=...&hid=...&document=...
&token=...&t=...

URL Final

hxxps[://]6b81e59848ba4a9d8cc3b4570b303a24[.]reports[.]sa[.]com/adfs/ls/?login_hint=
...&wa=wsignin1[.]0&wtrealm=...&wctx=...

Link inicial:

hxxps[://]expensereport[.]ch/phUV7JK4UV7ppQR5mQR5CD1CD1UV7xMN3tfJK4OP4gWX8vOP4YZ9k

Redirecionador:

hxxps[://]tfl[.]sapconcur[.]sa[.]com/expense/uid=...&hid=...&document=...&token=...&t=...

URL Final

hxxps[://]b4f1341373f341d98f11caea1052d878[.]laurimarierefling[.]com/?uid=...&hid=
...&document=...&token=...&t=...&...

Link inicial:

hxxps[://]concursolution[.]de/UV7JK4QR5CD1_CD1ST6tzST6EF2MN3mcQR5fST6ST6OP4cWX8m

Redirecionador:

hxxps[://]mcafee[.]concursystem[.]cv/auth/?uid=...&hid=...&document=...&token=...&t=...

URL Final

hxxps[://]3b2c66787c6349369fc9f90ecf789899[.]echosign[.]uk[.]com/
app/office365/.../wsfed/passive?login_hint=...&wa=wsignin1[.]0&...

Impersonificacao eficaz

Do ponto de vista do usuario, tudo parece um plano de fundo familiar do Microsoft, favicon e uma breve animacao de "por favor, aguarde" antes de um login. Enquanto isso, o kit desofusca o e-mail da vitima, marca dinamicamente a pagina de atracao subsequente com o nome da organizacao visada e carrega identificadores (uid/hid/document/token/t) atraves da cadeia para que quaisquer credenciais capturadas possam ser rastreadas de volta a uma campanha especifica. O padrao de URL repetivel- um subdominio personalizado mais o conjunto de parametros estavel - juntamente com o trecho de codigo anti-bot simplificado e o carregador estilo Office, fornece deteccao e agrupamento confiaveis em toda esta familia.

Objetivos da campanha & modus operandi

O objetivo principal desta campanha e a coleta de credenciais, com foco especifico na captura de credenciais de usuario e cookies de sessao ativos. A atividade observada demonstra uma clara intencao de ignorar ou capturar codigos de autenticacao multifator (MFA), indicando uma capacidade avancada alem do simples roubo de credenciais estaticas.

Verticais visados

Financas, Seguros e Bancos: Este e o setor vertical mais visado. Os invasores estao visando funcionarios de grandes bancos, empresas de investimento e seguradoras.
Tecnologia e servicos de TI: Grandes empresas de tecnologia, software e consultoria de TI sao os principais alvos, provavelmente devido ao seu acesso a valiosa propriedade intelectual e infraestrutura critica.
Saude, Produtos Farmaceuticos e Biotecnologia: Este setor e visado por seus dados confidenciais e pesquisa critica.
Aviacao, Viagem e Logistica: Direcionar este setor pode dar acesso a logistica de viagens, informacoes de reservas corporativas e dados confidenciais de funcionarios.
Manufatura e Automotivo: Gigantes Globais de Manufatura e Automotivo Tambem Estao na Lista.
Varejo e bens de consumo: inclui cadeias de varejo e empresas de produtos de consumo conhecidas.
Governo e Setor Publico: Varias agencias governamentais e organizacoes de servico publico sao alvos.

Pagina de chamariz

A pagina raiz dos dominios usados nesta campanha parece ser um jogo inofensivo de uma pagina intitulado "Artistic One Page" ou "Archery Master" para obscurecer o proposito da infraestrutura. Observe que, por causa desses titulos, uma consulta de pesquisa que pode ser usada para localizar infraestrutura adicional nesta campanha no urlscan.io, por exemplo:

page.title:("Artistic One Page" OR "Archery Master")

Esta pagina de isca pede aos visitantes que insiram um nome de usuario antes de jogar. O cliente bloqueia certos nomes de usuario (por exemplo: administrador, test e um filtro curto de palavras obscenas). Para qualquer outro nome de usuario, o site inicia imediatamente um jogo de arco e flecha incorporado e uma experiencia de quadro de lideres.

resposta a ameacas

O que estamos fazendo:

Estamos ativamente engajados nas seguintes atividades para mitigar essa ameaca:

Monitoramento continuo de dominios de phishing e infraestrutura recem-registrados associados a esta campanha.
Apresentar proativamente relatorios de abuso a registradores e provedores de hospedagem relevantes para iniciar solicitacoes de remocao para sites maliciosos identificados.
Fornecer orientacao e assistencia as organizacoes para aprimorar a seguranca de seus ambientes Okta e ajuda-las a investigar qualquer atividade suspeita relacionada a contas potencialmente comprometidas.

Controles Protetores

Recomendacoes para clientes

Registre os usuarios em autenticadores fortes, como Okta FastPass, FIDO2 WebAuthn e cartoes inteligentes, e aplique a resistencia ao phishing na politica.
As politicas de acesso de aplicativos Okta (anteriormente "politicas de autenticacao") tambem podem ser usadas para restringir o acesso a contas do usuario com base em uma variedade de pre-requisitos configuraveis pelo cliente. Recomendamos que os administradores restrinjam o acesso a aplicativos confidenciais a dispositivos gerenciados por ferramentas de Endpoint Management e protegidos por ferramentas de seguranca de endpoint. Para acesso a aplicativos menos confidenciais, exija dispositivos registrados (usando Okta FastPass) que exibam indicadores de higiene basica.
Negue ou exija maior garantia para solicitacoes de redes raramente usadas. Com o Okta Network Zones, o acesso pode ser controlado por local, ASN (Numero do Sistema Autonomo), IP e tipo de IP (que pode identificar proxies de anonimato conhecidos).
As avaliacoes de Comportamento e Risco da Okta podem ser usadas para identificar solicitacoes de acesso a aplicativos que se desviam de padroes de atividade do usuario estabelecidos anteriormente. As politicas podem ser configuradas para aumento de nivel ou negar solicitacoes usando este contexto.
Treine os usuarios para identificar indicadores de e-mails suspeitos, sites de phishing e tecnicas comuns de engenharia social usadas por invasores. Facilite para os usuarios relatarem problemas potenciais, configurando as Notificacoes para o Usuario Final e o Relatorio de Atividade Suspeita.
Documente, divulgue e siga um processo padronizado para validar a identidade de usuarios remotos que entram em contato com o pessoal de suporte de TI e vice-versa.
Adote uma abordagem de "Zero privilegios permanentes" para o acesso administrativo. Atribua aos administradores Funcoes de Administrador Personalizadas com as permissoes minimas necessarias para as tarefas diarias e exija autorizacao dupla para acesso JIT (just-in-time) a funcoes mais privilegiadas.
Aplique o IP Session Binding a todos os aplicativos administrativos para impedir a reproducao de sessoes administrativas roubadas.
Habilite as Protected Actions para forcar a reautenticacao sempre que um usuario administrativo tentar executar acoes confidenciais.

Observando e respondendo a infraestrutura de phishing:

Revise os registros de aplicativos (logs Okta, web proxies, sistemas de e-mail, servidores DNS, firewalls) para qualquer evidencia de comunicacao com quaisquer dominios suspeitos.
Monitore os dominios regularmente para ver se o conteudo muda.

Se o conteudo hospedado no dominio violar direitos autorais ou marcas legais, considere fornecer evidencias e emitir uma solicitacao de remocao com o registrador de dominio e/ou provedor de hospedagem na web.

Apendice A: Indicadores de Comprometimento

Esta e uma investigacao em andamento, e IOCs adicionais podem ser identificados a medida que a campanha evolui. As organizacoes sao aconselhadas a permanecer vigilantes e implementar as estrategias de mitigacao recomendadas. Abaixo estao os IOCs observados.

Type	Indicador	Comentario
dominio	acrobatsign[.]es	Pagina de destino suspeita
dominio	adobeacrobat[.]sa[.]com	Pagina de destino suspeita
dominio	adobesign[.]ceelegal[.]com	Pagina de destino suspeita
dominio	adobesign[.]pl	Pagina de destino suspeita
dominio	adobesign[.]us[.]com	Pagina de destino suspeita
dominio	asir[.]co[.]com	Pagina de destino suspeita
dominio	blue-styles[.]cz	Pagina de destino suspeita
dominio	ceelegal[.]com	Pagina de destino suspeita
dominio	codemonkey[.]cc	Pagina de destino suspeita
dominio	comcursolutions[.]de	Pagina de destino suspeita
dominio	comcursolutions[.]eu	Pagina de destino suspeita
dominio	comcursolutions[.]pl	Pagina de destino suspeita
dominio	comcursolutions[.]us	Pagina de destino suspeita
dominio	concur[.]cv	Pagina de destino suspeita
dominio	concur[.]pages[.]dev	Pagina de destino suspeita
dominio	concurexpense[.]pl	Pagina de destino suspeita
dominio	concurmgt[.]pl	Pagina de destino suspeita
dominio	concursap[.]netlify[.]app	Pagina de destino suspeita
dominio	concursecure[.]pl	Pagina de destino suspeita
dominio	concursolution[.]de	Pagina de destino suspeita
dominio	concursolution[.]pl	Pagina de destino suspeita
dominio	concursolutions[.]asia	Pagina de destino suspeita
dominio	concursolutions[.]at	Pagina de destino suspeita
dominio	concursolutions[.]ceelegal[.]com	Pagina de destino suspeita
dominio	concursolutions[.]ch	Pagina de destino suspeita
dominio	concursolutions[.]com	Pagina de destino suspeita
dominio	concursolutions[.]com[.]tr	Pagina de destino suspeita
dominio	concursolutions[.]cv	Pagina de destino suspeita
dominio	concursolutions[.]cz	Pagina de destino suspeita
dominio	concursolutions[.]de[.]com	Pagina de destino suspeita
dominio	concursolutions[.]es	Pagina de destino suspeita
dominio	concursolutions[.]in	Pagina de destino suspeita
dominio	concursolutions[.]mex[.]com	Pagina de destino suspeita
dominio	concursolutions[.]my	Pagina de destino suspeita
dominio	concursolutions[.]nl	Pagina de destino suspeita
dominio	concursolutions[.]pl	Pagina de destino suspeita
dominio	concursolutions[.]pt	Pagina de destino suspeita
dominio	concursolutions[.]re	Pagina de destino suspeita
dominio	concursystem[.]cv	Pagina de destino suspeita
dominio	concursystem[.]netlify[.]app	Pagina de destino suspeita
dominio	coupahost[.]pl	Pagina de destino suspeita
dominio	crsign[.]com	Pagina de destino suspeita
dominio	cruisesaudi[.]sa[.]com	Pagina de destino suspeita
dominio	dfwcom[.]com	Pagina de destino suspeita
dominio	dnglobal[.]ca	Pagina de destino suspeita
dominio	echosign[.]cv	Pagina de destino suspeita
dominio	echosign[.]de[.]com	Pagina de destino suspeita
dominio	echosign[.]eu02-safelink[.]com	Pagina de destino suspeita
dominio	echosign[.]nl	Pagina de destino suspeita
dominio	echosign[.]pl	Pagina de destino suspeita
dominio	echosign[.]ru[.]com	Pagina de destino suspeita
dominio	echosign[.]uk	Pagina de destino suspeita
dominio	echosign[.]za[.]com	Pagina de destino suspeita
dominio	esign[.]sa[.]com	Pagina de destino suspeita
dominio	eu02-safelink[.]com	Pagina de destino suspeita
dominio	eumai1-docusign[.]com	Pagina de destino suspeita
dominio	excelpediatric[.]us[.]com	Pagina de destino suspeita
dominio	expense[.]pl	Pagina de destino suspeita
dominio	expense[.]sa[.]com	Pagina de destino suspeita
dominio	expensereport[.]ch	Pagina de destino suspeita
dominio	expensereports[.]pages[.]dev	Pagina de destino suspeita
dominio	expensereports[.]pl	Pagina de destino suspeita
dominio	expensereports[.]pl	Pagina de destino suspeita
dominio	getadobesign[.]eu02-safelink[.]com	Pagina de destino suspeita
dominio	getconcur[.]pl	Pagina de destino suspeita
dominio	khs[.]co[.]com	Pagina de destino suspeita
dominio	knowbe4[.]es	Pagina de destino suspeita
dominio	meeting[.]sa[.]com	Pagina de destino suspeita
dominio	myapps[.]sa[.]com	Pagina de destino suspeita
dominio	na4-6l9[.]pages[.]dev	Pagina de destino suspeita
dominio	na4[.]it[.]com	Pagina de destino suspeita
dominio	saferedirect[.]pages[.]dev	Pagina de destino suspeita
dominio	sapconcur[.]cv	Pagina de destino suspeita
dominio	sapconcur[.]pages[.]dev	Pagina de destino suspeita
dominio	sapconcur[.]sa[.]com	Pagina de destino suspeita
dominio	sapconcursolutions[.]pl	Pagina de destino suspeita
dominio	scality[.]us[.]com	Pagina de destino suspeita
dominio	secure[.]za[.]com	Pagina de destino suspeita
dominio	sharepoint[.]za[.]com	Pagina de destino suspeita
dominio	supancasign[.]netlify[.]app	Pagina de destino suspeita
dominio	sutheha[.]za[.]com	Pagina de destino suspeita
dominio	team[.]sa[.]com	Pagina de destino suspeita
dominio	ug4t5w[.]cfd	Pagina de destino suspeita
dominio	wepp[.]website	Pagina de destino suspeita

Uma nota sobre a linguagem de estimativa

As equipes de Okta Threat Intelligence usam os seguintes termos para expressar probabilidade conforme descrito no US Office of the Director of National Intelligence, Intelligence Community Directive 203 - Analytic Standards.

Probabilidade	Quase nenhuma chance	Muito improvavel	Improvavel	Aproximadamente mesma chance	Provavel	Muito provavel	Quase com certeza
Probabilidade	Remoto	Altamente improvavel	Improbable	Aproximadamente chances iguais	Provavel	Altamente Provavel	Quase Certeza
Porcentagem	1-5%	5-20%	20-45%	45-55%	55-80%	80-95%	95-99%

Help desks targeted in social engineering campaign targeting HR applications

Mon, 29 Sep 2025 07:00:00 +0000

Resumo Executivo

A Inteligencia de Ameacas da Okta tem monitorado ativamente um grupo de atividades com motivacao financeira conhecido como O-UNC-034 desde agosto de 2025, que se aproveita da engenharia social da equipe de suporte tecnico para assumir contas e manipular dados em sistemas de folha de pagamento.

O-UNC-034 foi observado visando funcionarios de organizacoes que operam em diferentes setores, incluindo, entre outros, Educacao, Manufatura e Industria, Varejo e Servicos ao Consumidor, e Produtos Farmaceuticos e Saude. E um dos varios grupos de atividades rastreados pelo Okta Threat Intelligence e outros pesquisadores de ameacas que visam aplicativos de RH e folha de pagamento. Variacoes sobre este tema incluem o uso de *malvertising* (O-TA-54) e *AitM phishing* (STORM-2657).

O objetivo principal de O-UNC-034 e manipular os dados bancarios associados a usuarios-alvo em sistemas de RH e servicos relacionados a folha de pagamento.

Este aviso detalha as Taticas, Tecnicas e Procedimentos (TTPs) observados e fornece Indicadores de Comprometimento (IOCs) relevantes associados a esta ameaca ativa.

Estas informacoes sao fornecidas para fins informativos e de inteligencia, para permitir que as organizacoes compreendam e mitiguem os riscos representados por esta campanha.

Analise de Ameacas

O agente de ameacas esta utilizando tecnicas de engenharia social, se passando por funcionarios legitimos.

Para o Acesso Inicial, o agente de ameaca foi observado iniciando contato com a central de ajuda de TI da empresa-alvo, se passando por um funcionario. Eles usam essa personificacao para solicitar redefinicoes de senha para a conta do funcionario.

Apos um evento de redefinicao de senha bem-sucedido, o agente de ameaca estabelece persistencia ao registrar seu proprio autenticador MFA na conta comprometida. Observou-se que o agente de ameaca se inscreve no Okta Verify, autenticacao por chamada de voz, SMS ou manipula perguntas de seguranca, permitindo que o agente de ameaca ignore a autenticacao multifatorial (MFA) ou outros controles de seguranca.

Apos um comprometimento de conta bem-sucedido, o agente se volta para aplicativos internos, visando especificamente:

Aplicativos de folha de pagamento como Workday, Dayforce HCM e ADPsuite. O acesso a estes sistemas e utilizado para manipular os dados bancarios da conta comprometida.
Gerenciamento de relacionamento com o cliente (CRM) e gerenciamento de servicos de TI (ITSM), como Salesforce e ServiceNow. O acesso a essas plataformas pode levar ao roubo de dados de clientes proprietarios, propriedade intelectual ou manipulacao de processos de suporte de TI.
Suites de Colaboracao e Produtividade: Office 365 e Google Workspace. O acesso a esses ambientes fornece uma grande quantidade de informacoes, incluindo comunicacoes internas, documentos e credenciais, facilitando outros ataques.

O agente de ameacas foi observado tentando e autenticando com sucesso, a partir de uma combinacao de servicos de anonimato e enderecos IP residenciais, como:

IPVANISH VPN
CYBERGHOST VPN
ZENMATE VPN
EXPRESS VPN
WINDSCRIBE VPN
VPN FORTE
ZENLAYER
Enderecos IP geolocalizados na Nigeria

Varios sistemas operacionais tambem estao associados a esta atividade, incluindo, entre outros:

Mac OS 14.5.0 (Sonoma)
Mac OS 15.5.0 (Sequoia)
Mac OS 13.1.0 (Ventura)
Windows 11
iOS (iPhone)

resposta a ameacas

O que estamos fazendo

Estamos ativamente engajados nas seguintes atividades para mitigar essa ameaca:

Monitoramento continuo da atividade do agente de ameacas.
Fornecer orientacao e assistencia as organizacoes para aprimorar a seguranca de seus ambientes Okta e investigar qualquer atividade suspeita relacionada a contas potencialmente comprometidas.

Controles de Protecao

Recomendacoes

Incentive os usuarios a se registrarem em autenticadores fortes, como Okta FastPass, FIDO2 WebAuthn e cartoes inteligentes, e aplique a resistencia ao phishing na politica.
Documente, divulgue e siga um processo padronizado para validar a identidade de usuarios remotos que entram em contato com a equipe de suporte de TI e vice-versa. Considere o uso de servicos de verificacao de identidade quando os usuarios estiverem bloqueados fora de suas contas.
Recomendamos a criacao de funcoes de administrador personalizadas para profissionais de help desk de linha de frente. Esta funcao personalizada nao deve ter as permissoes necessarias para modificar fatores (redefinir senhas de usuario, definir senhas temporarias ou redefinir ou inscrever fatores). Em vez disso, esses profissionais de help desk devem receber em sua funcao personalizada a permissao para emitir Codigos de Acesso Temporario depois que um chamador para o help desk verificar com sucesso sua identidade. Ao contrario de um token de redefinicao de senha, um codigo de acesso temporario pode ter tempo limitado (sujeito a expiracao), ser atribuido a grupos especificos de usuarios (NB: excluir administradores e outros alvos de alto valor), encadeado a outros autenticadores e sujeito a politicas de acesso de app que restringem seu uso por dispositivo ou local.
As politicas de autenticacao do Okta tambem podem ser usadas para restringir o acesso a contas de usuario com base em uma variedade de pre-requisitos configuraveis pelo cliente. Recomendamos que os administradores restrinjam o acesso a aplicativos confidenciais a dispositivos que sao gerenciados por ferramentas de Endpoint Management e protegidos por ferramentas de seguranca de *endpoint*. Para acesso a aplicativos menos confidenciais, exija dispositivos registrados (usando o Okta FastPass) que exibam indicadores de higiene basica.
Negue ou exija maior garantia para solicitacoes de redes raramente usadas. Com as Zonas de Rede Okta, o acesso pode ser controlado por local, ASN (Numero de Sistema Autonomo), IP e Tipo de IP (que pode identificar proxies de anonimato conhecidos).
As avaliacoes de comportamento e risco da Okta podem ser usadas para identificar solicitacoes de acesso a aplicativos que se desviam de padroes de atividade do usuario previamente estabelecidos. As politicas podem ser configuradas para aumento de nivel ou negar solicitacoes usando este contexto.
Treine os usuarios para identificar indicadores de e-mails suspeitos, sites de phishing e tecnicas comuns de engenharia social usadas por invasores. Facilite para os usuarios relatarem problemas potenciais, configurando as Notificacoes para o Usuario Final e o Relatorio de Atividade Suspeita.
Adote uma abordagem de "Zero privilegios permanentes" para acesso administrativo. Atribua aos administradores Funcoes de Administrador Personalizadas com as permissoes minimas necessarias para as tarefas diarias e exija autorizacao dupla para acesso JIT (just-in-time) a funcoes mais privilegiadas.
Aplique o IP Session Binding a todos os aplicativos administrativos para impedir a reproducao de sessoes administrativas roubadas.
Ative Acoes Protegidas para forcar a reautenticacao sempre que um usuario administrativo tentar executar acoes confidenciais.

Indicadores de Comprometimento

Os contatos de seguranca dos clientes da Okta podem fazer login e baixar os Indicadores de Comprometimento de security.okta.com no seguinte link:

https://security.okta.com/product/okta/help-desks-targeted-in-social-engineering-campaign-targeting-hr-applications

Uma nota sobre a linguagem de estimativa

Probabilidade	Quase nenhuma chance	Muito improvavel	Improvavel	Aproximadamente igual probabilidade	Provavel	Muito provavel	Quase certo(a)
Probabilidade	Remoto	Altamente improvavel	Improbable	Aproximadamente mesmas chances	Provavel	Altamente Provavel	Quase Certeza
Porcentagem	1-5%	5-20%	20-45%	45-55%	55-80%	80-95%	95-99%

North Korea's IT Workers expand beyond US big tech

Simon Conant, Alex Tilley — Sun, 28 Sep 2025 22:00:00 +0000

A Okta Threat Intelligence conduziu uma analise em larga escala revelando que o esquema de trabalhadores de TI da Republica Popular Democratica da Coreia (RPDC) ameaca quase todos os setores que contratam talentos remotos.

Embora os relatorios publicos tenham se concentrado principalmente em cidadaos da RPDC visando funcoes de desenvolvimento de software em grandes empresas de tecnologia dos EUA, nossa analise mostra que essa ameaca nao se limita ao setor de tecnologia, nem aos EUA. Trabalhadores de TI norte-coreanos (ITW) agora representam uma ameaca real para uma ampla gama de setores. Os setores afetados incluem financas, saude, administracao publica e Professional Services em um numero crescente de paises. Este esquema generalizado tem como objetivo obter emprego ilicito e - em alguns casos - roubar dados confidenciais.

Qual a extensao dessa ameaca? Nossa analise de milhares de exemplos de nossa amostra de atividade DPRK ITW descobriu que organizacoes de Information and tecnologia representam apenas metade das entidades visadas. Tambem descobrimos que mais de um quarto (27%) das entidades visadas estao sediadas em paises que nao os Estados Unidos.

A Okta Threat Intelligence observou exemplos de atores ligados a Coreia do Norte passando por varias entrevistas para as mesmas funcoes. Embora nao tenhamos acesso aos processos de contratacao e integracao de todas as organizacoes, evidencias de atividades corporativas pos-integracao foram observadas em varias organizacoes em diferentes setores, apoiando a teoria de que uma abordagem ampla de "tiro disperso" para candidatura a empregos e entrevistas tem sido bem-sucedida o suficiente para torna-la um esforco valioso para o regime da Coreia do Norte continuar e expandir.

E essencial que organizacoes de todos os setores da industria e paises estejam cientes de que agentes ligados a RPDC se candidataram ou provavelmente se candidatarao a funcoes tecnicas remotas anunciadas e implementem as etapas extras cruciais necessarias para tornar sua organizacao um alvo mais dificil.

Dentro da investigacao: mais de 130 identidades e milhares de empresas visadas

Usando uma combinacao de fontes de dados internas e externas, o Okta Threat Intelligence rastreou mais de 130 identidades operadas por facilitadores e trabalhadores que participam do esquema DPRK ITW. Vinculamos esses atores a mais de 6.500 entrevistas de emprego iniciais em mais de 5.000 empresas distintas ate meados de 2025.

Para evitar alertar os agentes de ameacas sobre como obtivemos visibilidade de suas atividades, a Okta Threat Intelligence esta deliberadamente retendo alguns detalhes sobre nossa metodologia de pesquisa. Nossa confianca nos dados foi validada por briefings continuos com pares do setor, agencias de aplicacao da lei e Organizacoes-alvo.

Notavelmente, existem semelhancas superficiais entre os trabalhadores de TI da Coreia do Norte e os trabalhadores nao norte-coreanos de "sobre-emprego", como padroes de trabalho remoto, motivacoes financeiras, tecnicas de decepcao e origens geograficas. A Okta avalia qualquer identidade como alinhada a Coreia do Norte com base em uma combinacao de indicadores tecnicos, padroes comportamentais e relatorios de empregadores em primeira mao. Alem disso, prevemos que as 130 identidades que o Okta Threat Intelligence esta rastreando reflitam apenas uma pequena amostra da atividade total de TIW ativa da Coreia do Norte.

Um problema crescente

Nos ultimos cinco anos, pelo menos, a RPDC, fortemente sancionada, mobilizou milhares de individuos para paises vizinhos, encarregando-os de obter empregos ilicitos em paises desenvolvidos. Os ITWs da RPDC dependem de fraude de identidade e da colaboracao de facilitadores em paises-alvo para ajuda-los a obter e manter o emprego.

A pesquisa mais recente da Okta revela tanto a amplitude das industrias que estao sendo visadas quanto a duracao sustentada desta operacao, indicando um esforco de longo alcance e em evolucao para se infiltrar em empresas de todos os tipos em paises desenvolvidos. Um numero relativamente pequeno de pessoas foi capaz de identificar anuncios de emprego, gerar e enviar candidaturas personalizadas (incluindo CVs, cartas de apresentacao e materiais de apoio), passar pela triagem inicial de recrutadores ou RH e garantir entrevistas remotas em escala.

Embora o objetivo principal do esquema ITW permaneca o ganho financeiro por meio do pagamento de salarios, ha inumeros relatos surgindo de roubo de dados e tentativas de extorsao contra organizacoes que, sem saber, empregaram e posteriormente decidiram demitir esses trabalhadores.

Incidentes ocasionais de exfiltracao de dados e extorsao - incluindo atividade relacionada a ransomware - destacam a natureza de uso duplo desta campanha. O acesso proporcionado pela colocacao de pessoal ligado a RPDC dentro de organizacoes ocidentais oferece uma capacidade significativa de inteligencia e disrupcao caso o regime da RPDC decida usa-la. O potencial de acesso mais amplo e coleta tecnica construidos atraves desta operacao de longa duracao deve ser uma preocupacao para governos e organizacoes em quase todos os setores da economia.

Unidades DPRK ITW parecem estar aprendendo com erros anteriores e estao visando um numero maior de industrias em um numero maior de paises. Entidades visadas nesses paises agora enfrentam uma ameaca madura e experiente que alcancou o sucesso necessario para ter recebido um nivel de "liberdade criativa" sobre verticais visadas e as ferramentas, tecnicas e procedimentos que usam para obter emprego.

E possivel que o aumento da conscientizacao sobre essa ameaca - bem como os esforcos colaborativos do governo e do setor privado para identificar e interromper suas operacoes - possa ser um fator adicional para que eles visem cada vez mais funcoes fora dos EUA e das industrias de TI.

A RPDC esta ampliando seus alvos, de grandes empresas de tecnologia a hospitais, bancos e outros.

Nossa pesquisa demonstra uma clara progressao nos setores e funcoes que estao sendo visados no esquema ITW.

Embora a DPRK ITW busque esmagadoramente posicoes remotas de engenharia de software, nacionais da DPRK sao cada vez mais observados se candidatando a posicoes remotas de financas (processadores de pagamentos, etc.) e funcoes de engenharia. Isso sugere que funcoes remotas de qualquer tipo estao dentro do escopo do esquema. Enquanto a aplicacao, o processo de entrevista e o proprio trabalho puderem ser realizados remotamente, a DPRK tentara usar a oportunidade para coletar pagamento financeiro.

Nossa analise confirma que as candidaturas de emprego se estendem por quase todos os principais setores verticais. Nos ultimos quatro anos, podemos observar um aumento constante no numero de setores onde o ITW se candidatou e compareceu com sucesso a entrevistas de emprego. Como esperado, as grandes empresas de tecnologia - especialmente aquelas que desenvolvem software - permanecem sendo os alvos de maior volume. No entanto, outros setores verticais - incluindo financas, saude, administracao publica e Professional Services - surgem consistentemente em nosso conjunto de dados, demonstrando uma campanha continua e abrangente.

Existem varias explicacoes plausiveis para a distribuicao de entrevistas em verticais da industria:

A distribuicao e uma funcao de quais setores anunciam mais vagas remotas de engenharia de software. Mesmo entre os setores que mais anunciam engenheiros de software, certas categorias de trabalhadores do setor de tecnologia - como tecnologias de blockchain ou inteligencia artificial - mostram um aumento na quantidade de entrevistas que parece proporcional ao aumento da demanda por Developers e engenheiros.
A distribuicao reflete uma segmentacao deliberada de setores de interesse para o regime da RPDC para fins que nao sejam a geracao de receita e/ou as especializacoes ou experiencia de individuos especificos.
Nao podemos descartar a possibilidade de que esses individuos simplesmente tenham pouco interesse pela natureza ou negocio real das empresas visadas, alem da natureza remota da funcao.

As posicoes mais visadas permanecem em funcoes remotas de desenvolvimento de software (por exemplo, React, full stack, Java), com ocasionais outliers administrativos ou especializados, como contabilidade, processamento de pagamentos e suporte de engenharia. Nossa analise cronologica tambem revela distintos vales na atividade de entrevistas coincidindo com os periodos de feriados dos EUA e do Ocidente, provavelmente refletindo desaceleracoes sazonais nas contratacoes, em vez de uma mudanca na intencao do adversario.

Uma analise mais detalhada dos setores verticais visados pela RPDC

O Okta Threat Intelligence selecionou um subconjunto de verticais para uma analise mais profunda para ilustrar por que eles sao alvos e o impacto potencial de uma infiltracao bem-sucedida. Embora os exemplos sejam extraidos de setores especificos, as implicacoes se aplicam amplamente e servem como uma chamada para acao para todas as organizacoes.

Desenvolvimento de software e consultoria de TI

Os profissionais de TI da Coreia do Norte continuam a se concentrar esmagadoramente em funcoes remotas de desenvolvimento de software e consultoria de TI. Isso inclui nao apenas o emprego direto em empresas de tecnologia, mas tambem colocacoes em grandes provedores de terceirizacao e servicos. Essas posicoes oferecem salarios relativamente altos, acesso a bases de codigo, infraestrutura e pipelines de desenvolvimento de alto valor, alem de serem abundantes e frequentemente remotas.

A pesquisa da Okta mostra que esses atores identificam sistematicamente as funcoes anunciadas, criam curriculos e cartas de apresentacao confiaveis, passam pela triagem inicial de RH e garantem entrevistas em escala. A combinacao de trabalho remoto, contratacao por contrato e equipes distribuidas cria um ambiente onde as verificacoes de antecedentes e a verificacao de identidade tradicionais podem ser mais fracas, e a verificacao de identidade continua ou recorrente inexistente. Essa exposicao e ampliada em consultorias de TI, onde os trabalhadores sao frequentemente incorporados a varias organizacoes clientes, aumentando o risco de acesso lateral. O Okta Threat Intelligence tambem observou o uso significativo de plataformas de mercado freelancer por esses atores.

Inteligencia artificial

Desde meados de 2023, a Okta observou um aumento acentuado em entrevistas de emprego ligadas a Coreia do Norte em organizacoes focadas em IA, incluindo empresas de IA "puras" e empresas que incorporam IA em produtos e plataformas existentes. Esse aumento coincide com a expansao mais ampla do setor de IA e a corrida para dimensionar as equipes de engenharia - condicoes que podem reduzir o rigor da triagem e integracao de candidatos.

Embora parte desse aumento possa simplesmente refletir o boom geral na contratacao de IA, a exposicao de propriedade intelectual sensivel, dados de treinamento de modelos e algoritmos proprietarios torna este setor especialmente atraente para atores ligados ao Estado. A Okta avalia que os trabalhadores de TI da RPDC provavelmente estao se candidatando de forma oportunista ao numero crescente de vagas de IA, em vez de desviar recursos de outros setores. No entanto, o potencial de uso duplo do acesso a sistemas de IA - particularmente para manipulacao de modelos ou futuras operacoes ciberneticas ofensivas - aumenta o risco estrategico.

Assistencia medica e tecnologia medica

Mais surpreendentemente, observamos um numero constante de entrevistas de emprego ligadas a RPDC entre organizacoes de saude e tecnologia medica. A maioria das funcoes visadas se concentra no desenvolvimento de aplicativos moveis, sistemas de atendimento ao cliente e plataformas eletronicas de manutencao de registros (diretamente com provedores de tecnologia alinhados a area da saude, em vez de empresas de servicos genericas). Essas areas fornecem acesso potencial a informacoes de identificacao pessoal (PII) confidenciais, fluxos de trabalho clinicos e infraestrutura de dados de saude.

A sobreposicao entre tecnologia e assistencia medica transformou o setor em um alvo de alto valor. Embora as organizacoes focadas em medicina geralmente possam ser bem versadas na deteccao de credenciais medicas falsas "tradicionais" ou de um historico de trabalho preocupante, os trabalhadores de TI e os codificadores contingentes podem nao ter o mesmo nivel de escrutinio inicial ou continuo. As organizacoes de saude podem ter poucos recursos na deteccao de ameacas internas para combater tentativas de emprego fraudulentas, contando com processos de recrutamento tradicionais que podem nao detectar impostores sofisticados.

Nos EUA, contratar individuos ligados a paises sancionados para lidar com informacoes de saude protegidas pode ter implicacoes regulatorias significativas (por exemplo, violacoes do HIPAA).

O Okta Threat Intelligence avalia que os trabalhadores de TI ligados a DPRK podem ainda nao estar visando sistematicamente a assistencia medica, mas estao explorando a abundancia de funcoes de desenvolvimento de software a medida que o setor se digitaliza - aumentando os riscos para a seguranca de dados e a privacidade do paciente. No entanto, a sensibilidade do PII de assistencia medica o tornaria particularmente vulneravel a roubo de dados e extorsao.

Servicos financeiros

Os trabalhadores de TI da RPDC consistentemente se candidatam a funcoes no setor financeiro global. As entidades-alvo incluem instituicoes bancarias tradicionais e empresas de seguros, bem como empresas FinTech modernas e organizacoes relacionadas a criptomoedas.

Isso oferece a RPDC oportunidades de acesso direto a infraestruturas financeiras de alto valor, incluindo sistemas de processamento de pagamentos, dados de clientes e outros dados financeiros.

As funcoes visadas se expandiram alem do desenvolvimento de software para incluir funcoes de back-office e processamento financeiro em areas como folha de pagamento e contabilidade. Essa mudanca indica uma compreensao por parte da RPDC de que existem outros tipos de tarefas, alem da engenharia de software, que oferecem oportunidades semelhantes: uma entidade visada deve estar preparada para contratar remotamente, e um profissional de conhecimento da RPDC deve ser capaz de demonstrar algum nivel de competencia para executa-la.

A dependencia de servicos financeiros em recrutadores e prestadores de servicos terceirizados para talentos especializados cria um ambiente onde a verificacao de identidade nao e realizada diretamente pela organizacao contratante. Essa exposicao e particularmente aguda nos subsetores de Financas Descentralizadas (DeFi) e criptomoedas, onde uma cultura de contratacao rapida e remota pode criar lacunas significativas na verificacao, permitindo que os atores obtenham acesso confiavel a tesourarias de ativos digitais e protocolos essenciais.

Governo e administracao publica

A Okta observou um fluxo pequeno, mas persistente, de entrevistas de emprego entre trabalhadores de TI ligados a RPDC e departamentos do governo estadual e federal dos EUA entre 2023 e 2025, com exemplos adicionais em entidades governamentais do Oriente Medio e da Australia. Embora nossos dados nao confirmem se alguma dessas entrevistas resultou em emprego, as tentativas demonstram que as agencias governamentais nao sao imunes a campanha.

Mais significativa e a exposicao a administracao publica por meio de prestadores de servicos, provedores de servicos e consultorias governamentais. Essas organizacoes geralmente tem amplo acesso a redes governamentais e projetos confidenciais, mas enfrentam grandes volumes de contratacao, prazos curtos e grandes grupos de trabalhadores remotos. Se a triagem ou os controles de acesso falharem, os atores da Coreia do Norte podem obter entrada indireta em sistemas governamentais ou repositorios de dados confidenciais. A Okta avalia que os governos e seus fornecedores terceirizados devem adotar verificacao de identidade inicial e continua rigorosa e segregacao de acesso para reduzir o risco de infiltracao.

Terceirizacao e provedores de servicos de TI

Grandes provedores de servicos de outsourcing e TI aparecem frequentemente nos dados da Okta, refletindo seu recrutamento constante para funcoes tecnicas remotas e baseadas em contrato - exatamente o tipo de posicoes que os trabalhadores de TI ligados a Coreia do Norte buscam. Essas organizacoes normalmente anunciam em grande escala e processam altos volumes de candidatos, aumentando a chance de um adversario passar despercebido.

Embora muitas dessas empresas geralmente mantenham verificacoes de antecedentes e controles de seguranca robustos, o tamanho de sua forca de trabalho contingente e a natureza incorporada de sua equipe nos ambientes dos clientes criam um risco sistemico. Qualquer comprometimento em um provedor de servicos pode se estender a varias organizacoes de clientes, ampliando o impacto potencial. A Okta avalia que as Organizacoes devem tratar os prestadores de servicos e a equipe do provedor de servicos como potenciais ameacas internas e exigir de seus fornecedores verificacao de identidade, monitoramento e controles de acesso semelhantes aos usados para funcionarios diretos. Os processos de negocios e o acesso do fornecedor a dados e sistemas devem ser estritamente limitados ao minimo absoluto necessario, rigorosamente auditados e sujeitos a uma avaliacao de riscos rigorosa.

O alcance global da ameaca

A analise de Okta Threat Intelligence revela, como esperado, que a grande maioria das funcoes visadas (73%) foram anunciadas por empresas sediadas nos EUA. Exemplos da campanha de Trabalhadores de TI da RPDC foram identificados pela primeira vez nos EUA e continuaram la em grande escala. E provavel que tambem haja alguns vieses inerentes no conjunto de dados que analisamos que inclinam nossa amostra para alvos baseados nos EUA.

Dito isto, nossa analise revela uma expansao significativa das operacoes de ITW para outros paises (27% do total/nao-EUA), muitas vezes pelos mesmos atores DPRK que normalmente tem como alvo funcoes nos EUA. Reino Unido, Canada e Alemanha respondem por mais de 2% do total de observacoes (cada um representando aproximadamente 150 - 250 funcoes).

Ameaca crescente de uma forca de trabalho madura

A Okta avalia que, a medida que o foco da operacao do Trabalhador de TI da RPDC se espalha globalmente, a ameaca aos empregadores em paises recem-visados e elevada. Anos de atividade sustentada contra uma ampla gama de setores dos EUA permitiram que facilitadores e trabalhadores alinhados a RPDC refinassem seus metodos de infiltracao. Consequentemente, eles estao entrando em novos mercados com uma forca de trabalho madura e bem adaptada, capaz de ignorar os controles basicos de triagem e explorar os pipelines de contratacao de forma mais eficaz. Novos mercados que podem ver o esquema ITW como um "problema das grandes empresas de tecnologia dos EUA" tem menos probabilidade de ter investido tempo e esforco no amadurecimento de seus programas de ameacas internas. Os aspectos educacionais, tecnicos e gerenciais de tal programa exigem algum tempo e esforco para se tornarem eficazes.

A pesquisa da Okta Threat Intelligence mostra um grande volume de entrevistas de emprego iniciais concedidas a profissionais de TI ligados a Coreia do Norte em varios setores. Neste momento, temos menos confianca nas observacoes sobre quais aplicativos avancaram alem de uma primeira entrevista. Nossa amostra sugere que, no maximo, 10% desses candidatos progrediram para entrevistas de acompanhamento.

Essa taxa de sucesso nao deve ser tranquilizadora para os empregadores. A Okta analisou apenas um pequeno subconjunto do numero total compreendido de identidades fraudulentas ligadas as operacoes de DPRK IT Worker. Na escala desta atividade, mesmo um pequeno numero de candidatos que progridem com sucesso para a segunda ou terceira entrevista representa uma ameaca significativa. Basta uma contratacao comprometida - particularmente em uma funcao remota privilegiada ou de alto acesso - para permitir que os adversarios roubem dados, interrompam sistemas ou prejudiquem a reputacao e a confianca dos clientes. Funcoes de desenvolvimento de software geralmente exigem acesso elevado a dados e sistemas confidenciais, e essas permissoes sao frequentemente concedidas desde o inicio do emprego.

Esses atores foram observados usando diversos servicos online de idiomas e educacao tecnica para reforcar suas habilidades empregaveis. Eles tambem utilizam servicos de IA em suas tentativas de emprego.

Resposta a "pressao do mercado"?

Os agentes de ameacas no esquema ITW tem historicamente demonstrado menos sofisticacao tecnica do que suas contrapartes nas operacoes de espionagem e ransomware da RPDC. Isso nao diminuiu o sucesso deles. Os operadores de ITW da RPDC ganharam com sucesso dezenas de milhoes de dolares para o regime, e observamos variacao suficiente em suas taticas ao longo do tempo para concluir que agora desfrutam de autonomia significativa.

Mas a operacao ITW agora enfrenta uma nova ameaca: uma conscientizacao crescente e uma interrupcao coordenada de suas atividades. O escrutinio do esquema DPRK ITW dentro de seu vertical mais visado, o setor de tecnologia dos EUA, provavelmente interrompeu sua geracao de receita.

As unidades da DPRK encarregadas de operacoes de espionagem e ransomware agora veriam o modelo de contratacao ITW como um vetor nao para obter emprego e salarios incidentais, mas sim como uma oportunidade para roubo e extorsao de dados direcionados e persistentes. Ha indicacoes iniciais de que o acesso ITW ja esta sendo abusado para esses fins.

As organizacoes que contratam esses individuos atualmente enfrentam riscos relacionados a sancoes e danos a reputacao. No futuro, elas podem enfrentar roubo de dados deliberado e direcionado e operacoes de extorsao que exploram o mesmo acesso.

Implicacoes principais para organizacoes visadas

As descobertas da Okta revelam que a operacao de TI Worker da RPDC nao e uma ameaca de nicho confinada a grandes empresas de tecnologia. E uma campanha generalizada e de longo prazo que visa organizacoes em quase todas as verticais. Isso significa que qualquer organizacao que ofereca funcoes remotas ou hibridas - especialmente em desenvolvimento de software, servicos de TI ou outras disciplinas de trabalhador do conhecimento - e um alvo potencial.

A escala e a sofisticacao da operacao demonstram que os processos de recrutamento tradicionais, por si so, sao insuficientes para impedir a infiltracao. Cada contratacao comprometida pode fornecer a RPDC:

Ganho financeiro direto (pagamentos de salarios desviados para o regime)
Acesso interno privilegiado a sistemas, dados e redes confidenciais
Alavancagem operacional para ransomware, extorsao ou atividade cibernetica de acompanhamento
Perda de segredos corporativos sensiveis ao comercio
Coleta de inteligencia estrategica e acesso para suporte a futuras operacoes ofensivas

Alem disso, organizacoes que contratam inadvertidamente agentes da RPDC correm potencialmente o risco de violacao de fato das obrigacoes de sancoes e exposicao legal associada.

As organizacoes devem, portanto, adotar uma defesa em camadas, incluindo verificacao de identidade rigorosa durante o recrutamento, monitoramento continuo dos padroes de acesso e comportamento de trabalhadores remotos e um plano claro de resposta a incidentes para gerenciar ameacas internas ou a cadeia de suprimentos.

Etapas a serem tomadas para combater essa ameaca

A Okta Threat Intelligence avalia que organizacoes em todos os setores verticais - particularmente aquelas que anunciam funcoes remotas ou de contrato - devem adotar uma abordagem em camadas e proativa para recrutamento, integracao e monitoramento de ameacas internas. A Okta recomenda:

1. Fortalecer a verificacao da identidade do candidato

Exija verificacoes de identificacao emitidas pelo governo em varios estagios de recrutamento e emprego.
Verifique as localizacoes declaradas com enderecos IP (inclua a deteccao de uso de VPN), comportamento de fuso horario e informacoes bancarias da folha de pagamento.
Use servicos de terceiros credenciados para autenticar documentos de identidade, emprego anterior e credenciais academicas

2. Reforce os processos de recrutamento e triagem

Treine o RH e os recrutadores para identificar sinais de alerta. Incentive processos que identifiquem se um candidato e substituido entre as rodadas de entrevistas. Ensine-os a identificar sinais comportamentais, como pouco conhecimento da area em que afirmam residir, recusa em se encontrar pessoalmente, recusa em ligar a camera ou remover filtros de fundo durante as entrevistas ou fazer entrevistas usando uma conexao de internet muito ruim. Identifique curriculos duplicados, cronogramas inconsistentes, fusos horarios incompativeis e referencias nao verificaveis. Avalie a presenca online e nas redes sociais do candidato em relacao as informacoes fornecidas. Onde forem fornecidas evidencias de trabalhos anteriores, investigue se esses projetos foram simplesmente clonados dos repositorios de perfis do usuario legitimos.
Verifique o historico de edicoes de curriculos e PDFs nos metadados do documento e outros "sinais" tecnicos associados a duplicacao e reutilizacao.
Adicione verificacao tecnica e comportamental estruturada (codificacao ou escrita ao vivo realizada sob observacao do recrutador).
Exija referencias de e-mail corporativo (nao webmail gratuito) e confirme por meio de uma chamada de saida para os numeros da central telefonica principal da organizacao de referencia.

3. Impor controles de acesso segregados e baseados em funcao

Defina novos ou contingentes trabalhadores para perfis de menor privilegio por padrao e desbloqueie acesso adicional quando as verificacoes probatorias forem concluidas.

Segmente desenvolvimento, teste e producao; exija revisao por pares e fluxos de trabalho de aprovacao para mesclagens e implantacoes de codigo.

Monitore padroes de acesso anomalos (grandes extracoes de dados, logins fora do horario de trabalho de geolocalizacoes/VPNs inesperadas, compartilhamento de credenciais).

4. Monitore os prestadores de servicos e provedores de servicos terceirizados

Sempre que possivel, obrigue contratualmente padroes continuos de verificacao de identidade, verificacoes de antecedentes, politicas de autenticacao avancada, linhas de base de seguranca de dispositivos e direitos de auditoria.
Exija contas do usuario nomeadas (sem logins compartilhados ou contas de servico internas, sempre que possivel) e acesso separado de locatario/projeto para cada ambiente de cliente.

5. Implementar programas de conscientizacao sobre ameacas internas e conscientizacao sobre seguranca

Estabeleca uma funcao dedicada de risco interno ou, pelo menos, um grupo de trabalho que abranja RH, Juridico, Seguranca e TI.
Forneca treinamento direcionado para recrutadores, gerentes de contratacao e lideres tecnicos sobre as taticas de ITW e os controles de triagem.
Eduque e capacite os gerentes de contratacao e os membros da equipe a observar e enviar relatos de comportamentos potencialmente estranhos por parte de seus pares que levantem questoes sobre sua identidade, objetivos e locais.
Crie canais de relatorios mais seguros para comportamentos suspeitos ou preocupacoes com candidatos.

6. Coordene-se com a aplicacao da lei e pares do setor

Compartilhe indicadores de comprometimento e padroes de candidatos suspeitos com unidades nacionais de combate ao cibercrime e grupos ISAC/ISAO.
Desenvolva metodos para que o grupo de "risco interno" receba e acione indicadores (enderecos de e-mail, enderecos IP, provedores de VPN, criacao de documentos e indicadores comportamentais) e esteja preparado para "compartilhar de volta" as descobertas relevantes.
Participe ativamente de foruns de compartilhamento de informacoes para rastrear as taticas e ferramentas de ITW em evolucao.

7. Realize avaliacoes de risco e exercicios de red team regularmente

Modele caminhos de ataque de insiders e prestadores de servicos maliciosos; quantifique o impacto potencial nos negocios.
Realize exercicios de red team que testem o pipeline de contratacao (aplicativo e entrevistas simuladas da RPDC) para avaliar os processos de verificacao de identidade.
Atualize os planos de resposta a incidentes para incluir cenarios envolvendo agentes internos maliciosos, prestadores de servicos comprometidos e revogacao de acesso acelerada.

Conclusao

A analise da Okta demonstra que a campanha de Trabalhadores de TI da RPDC e uma operacao em grande escala e sustentada. Embora originalmente tenha como alvo empresas de tecnologia dos EUA, a campanha agora abrange quase todos os setores e varias regioes geograficas.

A escala e a duracao da atividade indicam um esforco sistematico para obter recursos financeiros, acesso tecnico e inteligencia estrategica dentro das organizacoes visadas. Um numero relativamente pequeno de identidades alinhadas a RPDC gerou milhares de entrevistas, evidenciando tanto persistencia quanto maturidade do processo. Apesar da ampla conscientizacao sobre essa ameaca, as tentativas de entrevista, o direcionamento e a metodologia continuam a crescer e evoluir.

Embora o desvio da folha de pagamento permaneca o motivador mais visivel, o risco estrategico se estende muito alem dos salarios. A colocacao bem-sucedida de ITW pode permitir a exfiltracao de dados, a interrupcao operacional e o estabelecimento silencioso de pontos de apoio de acesso interno que podem ser alavancados para espionagem, coercao ou futuras operacoes ciberneticas.

Organizacoes que ainda veem isso como uma questao "apenas para grandes empresas de tecnologia" correm o risco de subestimar sua exposicao. A evidencia apresentada neste relatorio deve servir como uma chamada a acao para fortalecer os controles de recrutamento e verificacao de identidade, elevar o monitoramento de prestadores de servicos e fornecedores terceirizados e garantir que os planos de resposta a incidentes abordem explicitamente vetores de entrada internos e da cadeia de suprimentos.

Com conscientizacao precoce, verificacao rigorosa e defesa coordenada, as organizacoes podem reduzir materialmente a probabilidade de contratar candidatos fraudulentos e limitar qualquer impacto potencial decorrente da infiltracao.