Retool SMS phishing, deepfaked call and Google Authenticator cloud sync
On August 27, 2023 attackers sent Retool employees SMS messages about a payroll issue linking to a fake login page; one employee entered credentials, then took a call from someone impersonating IT, using a deepfaked voice, and gave up an MFA code. Because Google Authenticator had synced the employee's MFA seeds to their Google account, compromising that account gave the attacker the employee's other factors as well. The attacker took over 27 cloud customer accounts, all in crypto.
- Victim
- Retool
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Aug 27, 2023
- First disclosed
- Sep 13, 2023
- Actor
- Financially motivated
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- 27 (Cloud customer accounts taken over, per Retool.)
- Disclosed cost
- Not disclosed
The identity lesson
Cloud-synced OTP seeds turn one compromised account into every factor. Phishing-resistant MFA bound to a device, with no shareable secret, would have stopped both the code relay and the sync takeover.
Go deeper on SWI
- Technique: OTP relay via social engineering
- Product involved: Google Authenticator
Sources
- When MFA isn't actually MFA, Retool, Sep 13, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- 0ktapus SMS phishing campaign against Okta users 2022 · Credential phishing
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
- Mixpanel smishing breach exposes OpenAI API user data 2025 · Credential phishing
- Workday CRM contact data taken in a social engineering campaign 2025 · Credential phishing
Cite this record
SWI Community Team. (2026). Retool SMS phishing, deepfaked call and Google Authenticator cloud sync. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-retool-sms-phishing-authenticator-sync/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.