Résumé
The Retool breach in 2023 is a tour of every modern phishing trick stacked on top of each other, and a warning about a feature you might have turned on. It started as a text message to employees about a fake payroll problem, timed to coincide with a real internal migration so it looked plausible. One employee clicked and entered their credentials and an MFA code. Then the attacker called them with a deepfaked, familiar-sounding voice and talked them into reading out one more code, which let the attacker hijack the employee's Okta account, and through it their Google account, where Google Authenticator's new cloud-sync feature had backed up every one of their MFA codes at once, turning multi-factor authentication back into single-factor. The attacker reached 27 cloud customers, all in crypto. It is the lesson that MFA's strength depends entirely on how it is implemented.
How it happened
The attack was SMS phishing, or smishing. Employees received texts impersonating IT about a payroll-system problem that would block the upcoming open enrollment for health benefits, linking to a fake Okta login portal, and crucially it was timed to coincide with a real, previously announced migration of logins to Okta, so the lure matched something the employees were actually expecting. One employee entered their credentials and an MFA code on the fake portal.
Then the attacker escalated with social engineering: they phoned the employee using a deepfaked, familiar-sounding voice and talked them into reading out one more code. That code was the load-bearing detail: it let the attacker enroll their own device on the employee's Okta account, producing valid Okta MFA from then on. Okta control then handed them an active Google (GSuite) session, and because Google Authenticator had recently added cloud sync, that Google access exposed all of the employee's synced one-time codes for internal services at once. What administrators believed was multi-factor authentication had, in Retool's own words, "silently (to administrators) become single-factor-authentication." The attacker used that access to reach 27 Retool cloud customers, all of them cryptocurrency companies (on-prem and self-managed customers were untouched), resetting user emails and passwords on the compromised tenants. Retool publicly blamed Google Authenticator's cloud-sync feature for amplifying the breach.
The damage
Twenty-seven crypto-company customers were breached through a single phished Retool employee. The downstream theft was real and large: about $15 million in cryptocurrency was stolen from customers of Fortress Trust, enough that Ripple, which was mid-acquisition of Fortress, fronted $15 million to make those customers whole. The incident became a case study in three things at once: the arrival of deepfaked voices in real attacks, the danger of cloud-synced one-time codes (a convenience that quietly breaks the "second factor on a separate device" model), and the effectiveness of timing a phish to a genuine internal event.
Why Retool still matters
Retool shows that MFA is not one thing, and how you implement it matters enormously. Cloud-synced TOTP codes mean that compromising one cloud account (Google) hands over all of your second factors, defeating the entire purpose of a second factor, and worst of all the change from multi-factor to single-factor was invisible to administrators. It also previews the deepfake-voice era of social engineering. The defences: use phishing-resistant hardware MFA (FIDO2 keys, which cannot be phoned out of you or synced to a cloud), disable cloud-synced TOTP for privileged accounts, treat SMS and voice as untrusted channels for authentication and never read a code to a caller, lock MFA-device enrollment behind strong verification with alerts on new devices, watch for smishing timed to real internal events, and isolate customer-facing admin systems so one employee compromise cannot reach many tenants. It uses the same smishing playbook as the Twilio breach.
Comment le corriger
- Reset the phished employee's credentials, remove the attacker-added MFA device, revert attacker-changed customer emails and passwords, and revoke sessions; move privileged staff to hardware keys.
- Notify the affected customers immediately, especially the crypto tenants at direct theft risk, and help them secure funds.
- Disable cloud-synced TOTP for privileged accounts so one cloud-account compromise cannot expose every second factor.
Comment l’éviter
- Use phishing-resistant hardware MFA (FIDO2 security keys); disable cloud-synced TOTP for privileged accounts.
- Treat SMS and voice as untrusted channels for authentication; never read an MFA code to a caller.
- Lock MFA-device enrollment behind strong verification and alert on every new-device addition.
- Watch for smishing tied to real internal events (migrations, payroll) that attackers time to look legitimate.
- Scope and isolate customer-facing admin systems so one employee compromise cannot reach many tenants.
Références
- https://retool.com/blog/mfa-isnt-mfa
- https://www.bleepingcomputer.com/news/security/retool-blames-breach-on-google-authenticator-mfa-cloud-sync-feature/
- https://www.coindesk.com/business/2023/09/13/phishing-attack-on-cloud-provider-with-fortune-500-clients-led-to-15m-crypto-theft-from-fortress-trust
- https://www.breaches.cloud/incidents/retool-mfa/
Vulnérabilités liées
Tout Phishing →- HIGHPHISH-AITM
Adversary-in-the-middle phishing defeats most multi-factor authentication by proxying the real login page. The victim is lured to a reverse-proxy site (Evilginx, EvilProxy, Tycoon 2FA) that relays every request to the genuine service, so the user completes username, password, and the MFA challenge against the real site while the proxy silently captures the resulting session cookie. With that cookie the attacker replays an already-authenticated session and skips MFA entirely, then often pivots to business email compromise. Microsoft tracked an AiTM campaign that attempted to target more than 10,000 organizations from September 2021. One-time-code and push MFA do not stop it; only phishing-resistant, origin-bound credentials do.
- HIGHPHISH-SPEAR-PHISHING
Spear phishing is a phishing attack crafted for a specific person or organization using reconnaissance (role, current projects, colleagues, vendors) so the lure looks legitimate, unlike high-volume bulk phishing. The payload is usually a credential-harvesting login page or a weaponized attachment. It is the dominant initial-access vector behind major breaches (RSA in 2011, the 2016 Clinton-campaign compromise) and the entry point for most ransomware and BEC. Because it exploits human trust rather than a software flaw, technical controls alone do not stop it: defense pairs detonation and email authentication with phishing-resistant MFA and least privilege so a single phished account is contained.
- HIGHPHISH-DNC-PODESTA-2016
In March 2016, the chairman of Hillary Clinton's presidential campaign got an email that looked like a routine Google security alert: someone has your password, change it now. He clicked, entered his password on the page it linked to, and that page belonged to Russian military intelligence. There was no malware and no software exploit, just one convincing fake login page and one click. The attackers, Fancy Bear, stole more than 50,000 of John Podesta's emails, a trove WikiLeaks then drip-fed in waves through the final weeks of the US election. It is the canonical example of how a single phishing email, aimed at the right person, can alter history.
- MEDIUMPHISH-QUISHING
Quishing delivers the phishing link as a QR code instead of a clickable URL, usually embedded in an email body, a PDF, or an image so it survives URL-reputation and link-scanning filters that only parse text. Scanning the code moves the victim onto a personal phone, outside enterprise EDR, proxy, and email controls, where a fake login page harvests credentials and is frequently chained with adversary-in-the-middle to steal the session. Adoption is rising fast: Microsoft reported QR-code phishing up roughly 146% and said pre-delivery scanning blocked about 1.5 million quishing attempts per day in 2024, and kits increasingly fold QR codes into OAuth device-code phishing flows.
- CRITICALPHISH-BEC
Business email compromise is a social-engineering fraud in which an attacker impersonates a trusted party (an executive, a supplier, an attorney, payroll) over email to trick staff into wiring money or changing payment details. No malware is required; it abuses trust and weak payment process. Attackers either spoof a lookalike domain or take over a real mailbox and watch threads to time the request to a live invoice. The FBI's Internet Crime Complaint Center ranks BEC the costliest cybercrime category by dollar losses, identifying roughly $51 billion in exposed losses globally between October 2013 and December 2022, rising to about $55 billion by 2023, reported across more than 177 countries. Common variants are CEO/wire fraud, vendor and invoice fraud, payroll diversion, and real-estate closing fraud.
- CRITICALPHISH-GOOGLE-FACEBOOK-BEC-2019
Between roughly 2013 and 2015, Lithuanian national Evaldas Rimasauskas ran a business email compromise scheme that defrauded Google and Facebook of about $120 million. He registered a company in Latvia under the same name as Quanta Computer, a Taiwan-based hardware maker both firms genuinely did business with, then emailed forged invoices, contracts, and letters on spoofed corporate letterhead to employees who routinely paid Quanta. The companies wired payments to attacker-controlled bank accounts (Facebook nearly $100 million and Google over $23 million) before the fraud was detected. Rimasauskas was arrested in March 2017, pleaded guilty to wire fraud in March 2019, and was sentenced to five years in prison and ordered to forfeit nearly $50 million. Both companies recovered most of the funds. It remains the textbook large-scale vendor-impersonation BEC.