0ktapus SMS phishing campaign against Okta users
Group-IB reported on August 25, 2022 that a campaign running since at least March 2022 sent SMS messages linking to fake Okta login pages, capturing 9,931 credential sets and 5,441 MFA codes from users at more than 130 organizations through 169 phishing domains. Victims included Twilio, Mailchimp and DoorDash; Okta tracked the actor as Scatter Swine and saw it use Twilio console access to read one-time passcodes.
- Victim
- Multiple: more than 130 organizations
- Industry
- Cross-industry
- Country
- Global
- Intrusion began
- Mar 2022
- First disclosed
- Aug 25, 2022
- Actor
- 0ktapus (Scatter Swine), later linked to Scattered Spider (Financially motivated)
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- 9,931 (9,931 credential sets and 5,441 MFA codes captured, per Group-IB.)
- Disclosed cost
- Not disclosed
The identity lesson
Phishing kits that relay passwords and one-time codes in real time defeat SMS and TOTP MFA; only origin-bound authenticators such as FIDO2 security keys resist them.
Regulatory and legal outcome
November 2024: U.S. prosecutors charged five men alleged to be members of the Scattered Spider and 0ktapus group.
Go deeper on SWI
- Technique: OTP relay via social engineering
- Product involved: Okta
Sources
- Roasting 0ktapus: The phishing campaign going after Okta identity credentials, Group-IB, Aug 25, 2022
- Detecting Scatter Swine: Insights into a Relentless Phishing Campaign, Okta, Aug 25, 2022
- Feds Charge Five Men in 'Scattered Spider' Roundup, KrebsOnSecurity, Nov 21, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Retool SMS phishing, deepfaked call and Google Authenticator cloud sync 2023 · Credential phishing
- Dexcom internal documents accessed after targeted vishing 2026 · Credential phishing
- ASOS customer data reached with an employee login obtained by impersonation 2026 · Credential phishing
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
Cite this record
SWI Community Team. (2026). 0ktapus SMS phishing campaign against Okta users. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-0ktapus-phishing-campaign/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.