Digital communication platform Twilio was hacked after a phishing marketing campaign tricked its staff into revealing their login credentials (through TechCrunch). The corporate disclosed the information breach in a publish on its weblog, noting that solely “a restricted quantity” of buyer accounts have been affected by the assault. Twilio permits net providers to ship SMS messages and place voice calls over phone networks and is utilized by corporations together with Uber, Twitter, and Airbnb.
The hack occurred on August 4th and concerned a nasty actor sending SMS messages to Twilio staff that requested them to reset their password or alerted them to a change of their schedule. Every message included a hyperlink with key phrases, like “Twilio,” “SSO” (single sign-on), and “Okta,” the title of the consumer authentication service utilized by many corporations. The hyperlink directed staff to a web page that mimicked an actual Twilio sign-in web page, permitting hackers to gather the data staff inputted there.
After it turned conscious of the breach, Twilio labored with US telephone carriers to close down the SMS scheme and likewise had webhosting platforms take down the phony sign-in pages. Regardless of this, Twilio says that hackers managed to swap to new internet hosting suppliers and cellular carriers to proceed their marketing campaign.
“Based mostly on these components, we’ve motive to imagine the menace actors are well-organized, refined and methodical of their motion,” Twilio provides. “Socially engineered assaults are — by their very nature — advanced, superior, and constructed to problem even probably the most superior defenses.”
Twilio’s working with regulation enforcement to search out out who’s chargeable for the marketing campaign and says it additionally heard from corporations that “have been topic to comparable assaults.” Twilio has since shut down entry to the compromised worker accounts and also will alert any clients affected by the breach.
Social engineering is changing into an more and more frequent tactic for hackers. Earlier this 12 months, a report from Bloomberg revealed that each Apple and Meta shared knowledge with hackers pretending to be regulation enforcement officers. Final 12 months, a hacker tricked a Robinhood customer support consultant into disclosing the data of over 7 million clients.