Hackers target FCC, crypto firms in advanced Okta phishing attacks

A new phishing kit named CryptoChameleon is being used to target Federal Communications Commission (FCC) employees, using specially crafted single sign-on (SSO) pages for Okta that appear remarkably similar to the originals. The same campaign also targets users and employees of cryptocurrency platforms, such as Binance, Coinbase, Kraken, and Gemini, using phishing pages that impersonate Okta, Gmail, iCloud, Outlook, Twitter, Yahoo, and AOL. The attackers orchestrate a complex phishing and social engineering attack consisting of email, SMS, and voice phishing to deceive victims into entering sensitive information on the phishing pages, such as their usernames, passwords, and, in some cases, even photo IDs. The phishing operation discovered by researchers at Lookout resembles the 2022 Oktapus campaign conducted by the Scattered Spider hacking group, but there is not enough evidence for a confident attribution. The threat actors prepare the attack by first registering domains that closely resemble those of legitimate entities. In the case of the FCC, they created "fcc-okta[.]com," which is only one different by one character from the FCC's legitimate Okta single-sign-on page. The attackers may call, email, or SMS the target, pretending to be customer support, directing them to the phishing site to "recover" their accounts. For Coinbase, the texts pretended to be warnings about suspicious login alerts, directing users to phishing pages, as shown below. Victims reaching the phish...