The Fall of Traditional 2FA
In 2022, a cybercrime group known as **0ktapus** launched a mass campaign targeting software companies. Over 130 major corporations—including Twilio, Mailchimp, and DoorDash—were breached.
How Adversary-in-the-Middle (AiTM) Bypasses OTP
Most people believe that Two-Factor Authentication (2FA) makes accounts un-hackable. However, **SMS codes and 6-digit authenticator app codes (TOTP) are vulnerable to reverse-proxy phishing**: 1. The attacker deploys a tool like `Evilginx`. 2. The attacker sends an SMS to an employee: *"IT Helpdesk: Click here to verify your SSO account."* 3. When the victim enters their email, password, and 6-digit 2FA code, the phishing server forwards those credentials to the real Okta server in real time. 4. The real Okta server authenticates the session and returns an active session cookie. 5. The phishing server captures the session cookie and hands it to the hacker.
The attacker does not need to crack the password—they possess the authenticated cookie!
Why Cloudflare Survived the Blitz
Cloudflare was also targeted by 0ktapus. Over 70 employees fell for the phishing link and entered their passwords. **Yet Cloudflare suffered zero breach**.
Why? Cloudflare had mandated **FIDO2 / WebAuthn hardware security keys (YubiKeys)** for all staff. Unlike SMS codes, WebAuthn cryptographically signs the domain name shown in the browser address bar. When employees tapped their YubiKeys on the phishing domain, the browser calculated the signature for `cloudflare-okta.fake`. The real Okta server rejected the signature because the cryptographic origin did not match `cloudflare.com`.