The help desk became the front door: lessons from Twilio and Okta

About this series

What happened in August 2022

In August 2022, a coordinated Phishing (show definition) campaign targeted employees at Twilio, a major communication platform. The attackers did not look for software bugs. Instead, they sent text messages to employees' personal and work phones. These messages claimed the employee's password had expired or their schedule had changed [2](https://postmortem.io/incidents/twilio--2022-08-04--employee-customer-account-compromise/).

The texts included links to fake login pages that looked exactly like the company's internal sign-in portal. When employees entered their credentials, the attackers captured them in real time. Because the employees were also prompted for their Multi-factor authentication (MFA) (show definition) codes, the attackers captured those too and immediately used them to log into the actual systems.

This campaign, named '0ktapus' by researchers, compromised over 130 organizations [4](https://www.bleepingcomputer.com/news/security/twilio-hackers-hit-over-130-orgs-in-massive-okta-phishing-attack/). By gaining access to Twilio, the attackers reached internal tools that held customer data. This allowed them to pivot to downstream targets, including customers of identity providers and encrypted messaging apps.

Why the attack worked

The primary weakness was the reliance on one-time codes sent via text message or generated by apps. While these codes are better than passwords alone, they are not 'phishing-resistant.' If a user can see the code, they can be tricked into typing it into a fake website.

The attackers also took advantage of the help desk's role as the 'front door.' Help desks are built to be helpful and resolve access issues quickly. By creating a sense of urgency through text messages, the attackers pushed employees to bypass their usual caution. This showed that even tech-savvy employees at major companies can be fooled by well-timed, relevant messages.

What this means for small businesses today

Many small businesses assume they are too small to be targets of such sophisticated campaigns. However, the '0ktapus' campaign proved that attackers use broad automation to find any entry point. If you use a third-party IT provider, they are your help desk. If an attacker compromises one of their technicians, they have access to every client that provider manages.

In 2026, we still see these patterns. The methods have changed slightly, but the goal is the same: get a human to hand over a code or click a link. For a small business, a single compromised account can lead to Ransomware (show definition) or total data loss.

Verification steps for your help desk

You must set clear rules for how your staff and your IT provider interact. The help desk should never accept a 'gut feeling' that a caller is who they say they are. Use these steps to harden your front door:

1. Mandate phishing-resistant MFA, such as hardware security keys, for any account with Administrator access (show definition).
2. Establish a 'callback' policy. If the help desk receives a request to reset a password, they must call the employee back on a known, registered number.
3. Use a secondary verification method, like a pre-shared code or a manager's approval, before changing a user's registered phone number or email.
4. Conduct regular 'vishing' (voice phishing) tests to see if your help desk follows the rules under pressure.

Staff training checklist

• Staff know that IT will never ask for an MFA code over text or a phone call.
• Employees are trained to report suspicious texts to the security team immediately.
• The business has a clear process for verifying identity before any password reset.
• All high-privilege accounts use physical security keys instead of text codes.