Real Time Vishing Kits Target Microsoft, Google and Okta Users

Du'aine Davis

Observed in the wild

• In January 2026, Okta Threat Intelligence observed active vishing campaigns using bespoke phishing kits sold “as‑a‑service”. Employees at organisations using Microsoft, Google, Okta and cryptocurrency platforms were targeted. Callers impersonated IT support, synchronising fake login pages with live phone scripts to coerce users into approving MFA challenges and surrendering credentials.
• Threat actors conduct reconnaissance, spoof helpdesk numbers, and direct victims to dynamic phishing sites. Client‑side scripts let callers modify pages in real time to mirror genuine Microsoft Entra or Okta MFA prompts (push, OTP, number matching). Credentials and MFA responses are relayed instantly (often via Telegram), enabling adversary‑in‑the‑middle attacks that bypass non‑phishing‑resistant MFA.
• Enforce phishing‑resistant MFA (FIDO2 security keys or passkeys) in Microsoft Entra ID; restrict access using Conditional Access, trusted locations and device compliance; monitor unusual MFA approvals and sign‑ins with Microsoft Defender for Identity and Defender for Cloud Apps; strengthen user awareness around unsolicited IT calls and MFA “push fatigue” behaviours.

Phishing kits adapt to the script of callers

Du'aine Davis

Escalating Vishing‑Led SaaS Data Theft Campaign by ShinyHunters
Observed in the wild

• In January, ShinyHunters‑branded extortion activity escalated, impacting organisations using cloud‑based SaaS platforms. Attackers stole sensitive internal data and communications for extortion and increasingly engaged in harassment of victim personnel.
• Threat actors impersonated IT staff via vishing calls, directing employees to convincing company‑branded credential‑harvesting sites. They stole SSO credentials and MFA codes, registered their own MFA devices, and accessed multiple SaaS apps to extract high‑value data. The campaign relies entirely on social engineering rather than exploiting vendor vulnerabilities.
• Organisations are advised to implement phishing‑resistant MFA (FIDO2 security keys or passkeys) to prevent credential interception. They should monitor for suspicious MFA device enrolment, unexpected SSO authentications, and widespread SaaS access from a single account

Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft | Google Cloud Blog