A threat group operating under the name "0ktapus" targeted over 130 companies in a large-scale phishing campaign that impersonated multi-factor authentication systems, according to Threatpost.

The attackers spoofed MFA prompts to deceive employees into revealing credentials and authentication codes. The campaign cast a wide net across numerous organizations, making it one of the broader phishing operations reported recently.

The name "0ktapus" appears to reference Okta, a widely used identity and access management platform. Threat actors commonly target MFA systems because they represent a critical security layer. When employees receive convincing fake MFA prompts, they often bypass normal skepticism and provide the requested codes, giving attackers direct access to corporate systems.

The scale of the operation—hitting 130 firms—demonstrates the attackers' ability to execute coordinated phishing at enterprise level. Each targeted company likely received tailored messages designed to appear legitimate within their own MFA workflows. The spoofing approach exploits user familiarity with routine authentication processes.

Okta and other MFA providers frequently recommend security practices to counteract such attacks. These include employee training on recognizing spoofed authentication requests, implementing conditional access policies, and monitoring for unusual login patterns. Organizations also benefit from requiring users to verify login locations and device information before entering codes.

The targeting of so many firms suggests the 0ktapus group operates with significant resources and technical capability. Rather than focusing on a single industry or geography, the broad victim count indicates either a financially motivated operation selling access, or attackers preparing infrastructure for follow-on attacks against specific sectors.

The campaign highlights an ongoing vulnerability in human security practices. Even as organizations deploy advanced MFA systems, attackers continue to exploit the human element through social engineering. Training remains one of the most effective defenses, yet phishing campaigns routinely succeed despite employee awareness programs.