3 ms·

The phishing against Twilio looks very much like the attempt on Cloudflare. I wonder how many other companies have been successfully phished that we don't know

• dont__panic 4y ago
  It certainly makes me wonder: it Twilio more competent because they noticed a phishing success? I assume there are plenty of people at every company who could fall for social engineering scams, so I think it's safe to say most companies aren't totally safe -- they just haven't noticed a major breach.
• tialaramex 4y ago
  Yes, Cloudflare pointed out the similarity and they suppose it's a single attacker with multiple targets. If you have access (I don't in my current role and I don't care enough to spend money to do this on my own account) you can ask a passive DNS system about names like cloudflare-okta.com that were used in the Cloudflare attack, identify patterns (same registrar, same hosting, that sort of thing) and also the IP addresses Cloudflare listed. You should probably assume that anywhere which doesn't actually have FIDO or similar and was actively targeted is screwed, because it only takes one lapse to let the bad guys in.