New Phishing Kit As-a-service Attacking Google, Microsoft, and Okta Users
A new generation of phishing kits designed for voice-based attacks has emerged as a significant threat to enterprise users across major technology platforms.
A new generation of phishing kits designed for voice-based attacks has emerged as a significant threat to enterprise users across major technology platforms.
Okta Threat Intelligence has identified multiple custom phishing kits available on an as-a-service basis, used by criminals in coordinated campaigns.
These tools target employees at companies such as Google, Microsoft, Okta, and cryptocurrency platforms with high precision.
The kits represent an evolution in phishing attacks, combining technical deception with real-time social engineering tactics to bypass modern security defenses .
These phishing-as-a-service kits mark a shift in attacker operations, replacing generic phishing pages with specialized tools that adapt in real-time to specific victim environments.
The kits intercept user credentials and display information convincing targets to approve multi-factor authentication (MFA) requests.
Okta Threat Intelligence has identified multiple custom phishing kits available on an as-a-service basis, used by criminals in coordinated campaigns.
Real-Time Session Orchestration and MFA Bypass
The infection mechanism begins with reconnaissance, as threat actors gather employee names, commonly used applications, and company IT support phone numbers before making contact.
Attackers deploy customized phishing pages and contact targets while impersonating official company numbers.
When victims enter credentials on fake login pages, attackers relay instructions for expected security notifications.
The phishing page shifts to display fake MFA challenge screens that mimic expected notifications.
Attackers can bypass push notification challenges by instructing victims over the phone to approve unseen notifications.
Phishing-resistant authentication methods such as Okta FastPass and FIDO passkeys offer protection against these attacks, as they cannot be compromised through social engineering alone.
The growth of phishing-as-a-service operations demonstrates the professionalization of cybercriminal infrastructure.
Threat actors now sell access to control panels customized for individual services, indicating increased specialization.
Organizations should enforce phishing-resistant authentication for critical resources and implement network restrictions to block access from anonymizing services used by threat actors.
Based on reporting by Cyber Security News.