Summary
On 7 August 2022, Twilio, a company whose entire business is sending text messages and verification codes for other companies, was breached through text messages. Attackers ran an SMS phishing campaign against Twilio's own employees, texting them fake "your password expired" alerts from numbers that looked like Twilio IT and linking to convincing fake login pages. Several staff entered their credentials, handing over access to internal tools and the data of more than 200 customers, and rippling downstream to users of the secure-messaging app Signal. It was one strike in a sprawling campaign, dubbed 0ktapus, that phished around 130 companies the same way. It is the lesson that phishing-resistant MFA exists for a reason: ordinary credentials and codes can always be talked out of a human.
How it happened
The attack was SMS phishing, or smishing. Twilio employees received text messages impersonating Twilio IT, warning of password expiry or schedule changes and using real-sounding terms like Okta and SSO, directing them to fake login pages that harvested their credentials and relayed the one-time codes to the attacker in real time. Group-IB's analysis of the phishing kit found it captured 9,931 account logins and 5,441 MFA codes across the wider campaign. Several Twilio employees fell for it, and that was enough: the attackers reached internal tools and accessed data belonging to 209 Twilio customers, plus 93 users of its Authy two-factor app. It was, in fact, Twilio's second breach in months; back in June 2022 the same actors had used a fraudulent IT phone call (voice phishing) to trick an employee out of credentials.
The damage did not stop at Twilio. Because the secure-messaging app Signal uses Twilio to send its SMS verification codes, roughly 1,900 Signal users had their phone numbers or verification codes exposed, and at least one Signal account was re-registered to an attacker's device, though Signal's design kept message content and contact lists protected. This was one node in the much larger 0ktapus campaign, tracked as 0ktapus and Scatter Swine and later folded into the broader Scattered Spider collective, which used the same social engineering playbook against around 130 organisations.
The damage
Beyond the 209 Twilio customers, the breach exposed how one phished employee at an infrastructure provider cascades outward, to that provider's customers, and then to their customers' users. The 0ktapus campaign as a whole compromised a swath of major technology and telecom companies. Notably, one target hit by the exact same campaign did not fall: Cloudflare. At least 76 of its employees were smished from a look-alike domain registered minutes before, and three entered their credentials, but their accounts were protected by phishing-resistant hardware security keys, which the attackers could not defeat.
Why Twilio still matters
Twilio is the lesson that social engineering beats ordinary MFA, and that a communications provider's breach is a supply-chain event for everyone who relies on it. The contrast with Cloudflare is the whole point: one-time codes and push prompts can be phished or relayed by a human in real time, but FIDO2 and passkey hardware keys cannot, because they are cryptographically bound to the real site, so entering your password on a fake page gets the attacker nothing. The defences are to deploy phishing-resistant MFA, train relentlessly against smishing, limit and monitor internal-tool access, and keep a downstream-notification plan ready. The same loose collective went on to run the MGM and Caesars attack.
How to fix it
- Reset credentials and revoke sessions for all phished employees, and move the organisation to phishing-resistant hardware-key MFA.
- Notify affected customers and downstream users quickly (Twilio and Signal both did), and re-secure any accounts re-registered to attacker devices.
- Hunt internal tools and logs for the attacker's access and scope exactly which customer data was reached.
How to avoid it
- Deploy phishing-resistant MFA (FIDO2/WebAuthn hardware keys or passkeys); the same campaign failed against companies that used them.
- Train and test employees against SMS and voice phishing, and make it easy to report suspicious "IT" messages.
- Limit internal-tool access with least privilege, and monitor for logins and tool use from unexpected devices or locations.
- Maintain a downstream-notification plan; as an infrastructure provider, your breach is also your customers' breach.
- Treat "your password is expiring, log in here" messages as the classic lure they are, in training and in email/SMS filtering.
References
Related vulnerabilities
All OpSec →- CRITICALOPSEC-MIDNIGHT-BLIZZARD-2024
In January 2024, Microsoft revealed that Russia's foreign-intelligence service, the same APT29 behind SolarWinds, had been reading the email of its senior leadership. The way in was almost insulting in its simplicity: a forgotten, non-production test account with a weak password and no MFA. The attackers guessed the password by spraying common ones across many accounts, then pivoted through a forgotten over-privileged application to grant themselves access to corporate mailboxes, including those of executives and the security and legal teams. It is the lesson that your security is only as strong as the account you forgot about, and that even Microsoft's perimeter fell to a missing MFA checkbox.
- CRITICALOPSEC-LASTPASS-2022
LastPass is a password manager, the digital vault tens of millions of people trusted with every password they have. In 2022 attackers got into it, and the breach unfolded in a way that turned a developer's home computer into a path to those vaults. A first intrusion stole source code. The attackers used it to identify and target one of only four engineers who held the keys to production backups, planting a keylogger on his home PC through an unpatched flaw in, of all things, his Plex media server. With his master password captured, they exfiltrated backups of customers' encrypted password vaults. The encryption held, but anyone with a weak master password was now exposed to offline cracking at the attacker's leisure. It is the lesson that a vault is only as strong as the master password protecting it, and that your blast radius includes your engineers' home machines.
- HIGHOPSEC-INTERNET-ARCHIVE-2024
The Internet Archive, the nonprofit behind the Wayback Machine, had a brutal October 2024: a data breach, a website defacement, and a wave of DDoS attacks, all at once. Underneath the chaos was an unglamorous root cause. An authentication token sat in plain text in a public config file; the team rotated it repeatedly, but each new token landed right back in the same exposed file, so the leak never actually closed. With it, an attacker downloaded the source code, found more credentials hardcoded inside, and walked out with a database of 31 million users. Weeks later a second token from that same stolen code, for the support system, exposed 800,000 support tickets, some with people's ID documents. It is the lesson that rotating a secret is useless if it goes straight back into a public file, and that one leak unravels everything.
- CRITICALOPSEC-SNOWFLAKE-2024
In mid-2024, a single gap, accounts without multi-factor authentication, turned into one of the largest waves of data theft ever, hitting Ticketmaster, AT&T, Santander, and around 165 other companies at once. The attackers never broke Snowflake, the cloud data platform all of them used. They simply logged in with valid usernames and passwords, harvested months or years earlier by infostealer malware from employees' personal computers and bought on criminal markets. Where MFA was not turned on, a stolen password was a full key. It is the defining lesson of the infostealer era: your breach can start on an employee's home laptop, and MFA is the difference between a leaked password and a catastrophe.
- HIGHOPSEC-MERCEDES-BENZ-2024
Publicly disclosed January 30, 2024, a Mercedes-Benz employee accidentally committed a GitHub authentication token to a public repository, leaving it exposed from September 29, 2023. RedHunt Labs found the token during an internet-wide scan; it granted unrestricted, unmonitored access to Mercedes-Benz's internal GitHub Enterprise Server, allowing anyone to download private source-code repositories that could contain API keys, cloud access keys, database connection strings, blueprints, and SSO passwords. After notification, the token was revoked on January 24, 2024. Mercedes-Benz stated customer data was not affected but could not confirm whether anyone besides the researchers accessed the repositories during the exposure window.
- HIGHOPSEC-OKTA-2023
Okta is an identity provider: the single front door thousands of companies use to log their employees into everything. So when Okta's customer-support system was breached in late 2023, the blast radius was a who's-who of security-conscious companies. The entry point was almost mundane. An employee had signed into their personal Google account on an Okta laptop and saved a corporate service-account password into it; the attacker got that password and walked into Okta's support system. There they downloaded diagnostic files that customers had uploaded, some of which contained live session tokens, and used those tokens to step directly into the customers' own Okta environments. It is the lesson that session tokens are as good as passwords, support systems are production systems, and a personal browser profile can be the crack in the wall.