Wiz Details Methods for Finding 0ktapus Phishing Domains
Summary
Wiz outlines ways to pivot across phishing pages, network fingerprints and registration data to find 0ktapus-linked domains, identifying multiple DOM templates and new domains while cautioning that shared kits complicate attribution.
Key points
- The article summarizes 12 DOM templates associated with phishing pages observed across campaigns from 2022 to 2024, while noting the list may not be comprehensive.
- Researchers describe pivoting on page code, scripts, DOM hashes and copied website assets; a logo hash helped link phishing domains impersonating DoorDash, including okta-verify[.]com and calendar-dd[.]com.
- Network clues include TLS certificate patterns, open ports, shared infrastructure, redirects, DNS hosting and domain naming conventions.
- Registration patterns—including shared nameservers, registrars and registration timing—helped uncover dashboard-mailgun[.]com and a previously unknown page template.
- The authors caution that shared phishing kits and public assets can complicate attribution; domains in a cluster are not necessarily all operated by 0ktapus.
- Defensive recommendations include enforcing MFA and SSO, restricting access to managed or registered devices, and monitoring Okta sign-ins for unusual device registrations or MFA changes.
Article Details
- Attack Vectors
- 0ktapus uses phishing landing pages that mimic target organizations’ login pages to collect credentials and gain initial access.
- The article reports social-engineering methods including smishing, vishing, MFA fatigue, and SIM hijacking.
- The actor targets IT service desk workers and administrators and may revisit previously compromised victims.
- The actor uses newly registered, short-lived phishing domains, sometimes ages them before use, and has used URL-shortening services to disguise phishing destinations.
- Defensive Notes
- Enforce MFA and single sign-on where possible; secure MFA and self-service password reset enrollment by requiring a trusted network location or compliant device.
- Restrict application access to registered devices using Okta FastPass or devices managed by endpoint-management tools.
- Monitor Okta sign-in behavior for deviations and investigate new device registrations with a different operating system or older model, one device ID assigned to multiple identities, and external email addresses added as MFA options.
- Hunt for phishing infrastructure by correlating page and script fingerprints, TLS and server-port characteristics, DNS and domain-registration patterns, and reused infrastructure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | account[.]kemper-support[.]com | Phishing domain mimicking DoorDash-related login pages and using a replicated logo. |
| DOMAIN | att-mfa[.]com | Example phishing domain using 0ktapus DOM Template C. |
| DOMAIN | calendar-dd[.]com | Phishing domain using DOM Template G and containing scripts described as harmful. |
| DOMAIN | dashboard-mailgun[.]com | Phishing domain discovered by Wiz Research and associated with DOM Template E. |
| DOMAIN | gemini-sso[.]com | Example phishing domain using DOM Template B, which submits victim credentials. |
| DOMAIN | grid-review[.]com | Example phishing domain using DOM Template K. |
| DOMAIN | intercom-okta[.]com | Example phishing domain using 0ktapus DOM Template I. |
| DOMAIN | klav-workday[.]com | Example phishing domain using DOM Template J, which posts victim responses. |
| DOMAIN | login[.]doordash-support[.]com | Phishing domain mimicking DoorDash-related login pages and using a replicated logo. |
| DOMAIN | mailgun-okta[.]com | Phishing domain reported as reused in campaigns in August 2022 and May of the article’s publication year. |
| DOMAIN | mgmresorts-okta[.]com | Example phishing domain using DOM Template F. |
| DOMAIN | nike-support[.]com | Phishing domain whose page replicated a resource from a legitimate login site. |
| DOMAIN | okta-verify[.]com | Phishing domain mimicking DoorDash-related login pages and using a replicated logo. |
| DOMAIN | rejectauth-sendgrid[.]com | Example phishing domain using DOM Template L. |
| DOMAIN | revolut-ticket[.]com | Example phishing domain using 0ktapus DOM Template A. |
| DOMAIN | securian-hr[.]com | Phishing domain whose page showed the recurring HTML syntax error associated with DOM Template A. |
| DOMAIN | stargate-okta[.]com | Example phishing domain using 0ktapus DOM Template D. |
| DOMAIN | t-mobile-okta[.]com | Example phishing domain using DOM Template H, which posts victim data. |
| DOMAIN | www[.]dashsso[.]com | Phishing domain mimicking DoorDash-related login pages and using a replicated logo. |
| SHA256 | 46e7cf1fb46a73f098fa6f0f46732bdd298af690ec1452fac9b97884ca8b5a39 | Hash of a DOM sample associated with phishing pages using the recurring Template A characteristics. |
| SHA256 | 5dd491b89daadabfe8419d5d1e436a6dd9b4eea25fc4ba5898e6a1bca34f06e9 | Hash of a DOM sample associated with phishing pages using the recurring Template A characteristics. |
| SHA256 | 69b575025bd763e58fcb95035b9b6e358f43737d91e01ebdaa19934e0206a966 | SHA-256 hash associated with the phishing-page authorization.php artifact in DOM Template J. |
| SHA256 | 95a0eca17ee49bebb333bbb1c96ab54ed361c2f233b2adf8c4374814c633a53b | DOM hash identifying a phishing-page template used by 0ktapus. |
| SHA256 | 98ca25eef00efcafee4f9cb07908776d0ad976296a5e6eb07a724c31ae4bfc61 | DOM hash identifying a phishing-page template used by 0ktapus. |
| SHA256 | f8b7bb31e7e8c574d74e52eba7dcf3de48c7f5fa6d39d64685d39355d688defb | Hash of a phishing-page DOM sample that revealed additional phishing domains. |
| SHA256 | fb1d07ab6c54c7380a93a507b48bc5ba0aee77ca32b7d4c57c38f007857a6fd1 | DOM hash identifying a phishing-page template used by 0ktapus. |
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe phishing pages collect credentials entered by victims, including through forms that POST victim credentials.T1566.002 · Spearphishing LinkThe actor directs potential victims to phishing landing pages that mimic legitimate organization login pages.T1583.001 · DomainsThe actor registers domains for phishing campaigns, including domains described as short-lived or deliberately aged before use.T1621 · Multi-Factor Authentication Request GenerationThe article identifies MFA fatigue as a social-engineering method used by 0ktapus.
People
Threat Actors
0ktapusFinancially motivated threat actor active since 2022; the article explicitly identifies the other listed names as aliases.Scatter SwineExplicitly identified in the article as an alias of 0ktapus.Scattered SpiderExplicitly identified in the article as an alias of 0ktapus.StarfraudExplicitly identified in the article as an alias of 0ktapus.UNC3944Explicitly identified in the article as an alias of 0ktapus.
Vendors
OktaUnique Characteristics: Hidden link to https://n[redacted].okta[.]com + POST victim credentials to f[redacted].php, while redirecting victim to factor.html / 2FA + form information is submitted tofactor.php (exampleWizReferences: Wiz Research surfaced this template by examining domain registrations linked to common nameservers known to be used by 0ktapus.
Products
OktaUnique Characteristics: Hidden link to https://n[redacted].okta[.]com + POST victim credentials to f[redacted].php, while redirecting victim to factor.html / 2FA + form information is submitted tofactor.php (exampleOkta FastpassRestrict access to applications to only those devices that are registered (with Okta FastPass) or devices managed by endpoint management tools.Wiz Security GraphWiz extends support to Okta with identity modeling on the Wiz Security Graph, visibility, risk assessment, and real-time threat detection for your Okta environment
Tools
Censysof these methods can be employed using various threat hunting platforms, including VirusTotal, URLScan, Censys and others.urlscan.ioEach of these methods can be employed using various threat hunting platforms, including VirusTotal, URLScan, Censys and others.Validinblogpost have been previously detailed in past reports, including from GroupIB, TLP_R3D, EclecticIQ, Validin, SilentPush, Mandiant and others, we believe there is significant value in compiling all these methodsVirusTotalanalysis. Each of these methods can be employed using various threat hunting platforms, including VirusTotal, URLScan, Censys and others.