Digital communication platform Twilio was hacked after a phishing marketing campaign tricked its staff into revealing their login credentials (via TechCrunch). The corporate disclosed the info breach in a post on its blog, noting that solely “a restricted quantity” of buyer accounts have been affected by the assault. Twilio permits net companies to ship SMS messages and place voice calls over phone networks and is utilized by firms together with Uber, Twitter, and Airbnb.
The hack occurred on August 4th and concerned a foul actor sending SMS messages to Twilio staff that requested them to reset their password or alerted them to a change of their schedule. Every message included a hyperlink with key phrases, like “Twilio,” “SSO” (single sign-on), and “Okta,” the title of the consumer authentication service utilized by many firms. The hyperlink directed staff to a web page that mimicked an actual Twilio sign-in web page, permitting hackers to gather the knowledge staff inputted there.
After it turned conscious of the breach, Twilio labored with US cellphone carriers to close down the SMS scheme and likewise had website hosting platforms take down the phony sign-in pages. Regardless of this, Twilio says that hackers managed to swap to new internet hosting suppliers and cellular carriers to proceed their marketing campaign.
“Based mostly on these components, we’ve got cause to imagine the risk actors are well-organized, subtle and methodical of their motion,” Twilio provides. “Socially engineered assaults are — by their very nature — complicated, superior, and constructed to problem even probably the most superior defenses.”
Twilio’s working with legislation enforcement to seek out out who’s liable for the marketing campaign and says it additionally heard from firms that “have been topic to comparable assaults.” Twilio has since shut down entry to the compromised worker accounts and also will alert any prospects affected by the breach.
Social engineering is turning into an more and more widespread tactic for hackers. Earlier this 12 months, a report from Bloomberg revealed that each Apple and Meta shared information with hackers pretending to be legislation enforcement officers. Final 12 months, a hacker tricked a Robinhood customer support consultant into disclosing the knowledge of over 7 million prospects.