The Rise of Adversary-in-the-Middle Smishing
In the summer of 2022, cybersecurity firm Group-IB uncovered one of the most prolific mobile phishing operations in history, codenamed Oktapus.
The campaign systematically breached communications provider Twilio, food delivery giant DoorDash, email marketing platform Mailchimp, and over 130 other high-profile tech corporations.
The attack demonstrated that traditional Multi-Factor Authentication (SMS and authenticator push notifications) is vulnerable to real-time automated phishing proxy kits.
Key Incident Metric: 130+ tech firms targeted, 9,931 credentials harvested, and 5,400+ 2FA session tokens intercepted in real time.
How Oktapus Intercepted Real-Time MFA
The attackers built an automated Adversary-in-the-Middle (AiTM) phishing pipeline:
- Targeted Mobile SMS: Employees received personalized SMS text messages reading: "Your company schedule has been updated. Please sign in here: company-sso.com" or "Your Okta password expires in 2 hours."
- Convincing Cloned Portals: Clicking the link loaded a replica of the company's genuine Okta Single Sign-On (SSO) login screen.
- Real-Time Proxying: When the employee entered their username and password, the phishing server instantly forwarded those credentials to the real corporate Okta server.
- Capturing the 2FA Code: The genuine server generated an SMS verification code to the employee's phone. When the employee entered it into the fake website, the script captured the session cookie, granting the attackers complete authenticated access to internal corporate systems.
The Twilio & Signal Fallout
At Twilio, attackers used compromised staff accounts to access internal customer support consoles. From there, they compromised account records belonging to 125 customers — and attempted to re-register the Signal private messenger accounts of prominent investigative journalists.
Why Traditional MFA Failed
The Oktapus campaign proved that not all Multi-Factor Authentication is created equal:
- SMS Codes Are Not Phishing-Resistant: If an employee is tricked into typing a 6-digit code into a fake website, the code can be relayed to the real service within seconds.
- Push Fatigue & Deception: Prompting users for approval without cryptographic binding to the browser URL leaves the door open to credential theft.
Modern Defenses Against Smishing & AiTM
- Deploy FIDO2 / WebAuthn Hardware Keys: Security keys like YubiKeys are cryptographically bound to the exact browser domain, making it mathematically impossible for an AiTM proxy to intercept authentication tokens.
- Employee Smishing Simulations: Train employees on mobile security threats — smishing click-rates are often 3x higher than desktop email phishing.
- Zero-Trust Device Posture Checking: Restrict access to internal Single Sign-On portals so only pre-registered, MDM-managed corporate laptops can log in.