Digital communication platform Twilio was hacked after a phishing marketing campaign tricked its workers into revealing their login credentials (via TechCrunch). The corporate disclosed the information breach in a post on its blog, noting that solely “a restricted quantity” of buyer accounts have been affected by the assault. Twilio permits internet companies to ship SMS messages and place voice calls over phone networks and is utilized by firms together with Uber, Twitter, and Airbnb.
The hack occurred on August 4th and concerned a nasty actor sending SMS messages to Twilio workers that requested them to reset their password or alerted them to a change of their schedule. Every message included a hyperlink with key phrases, like “Twilio,” “SSO” (single sign-on), and “Okta,” the title of the consumer authentication service utilized by many firms. The hyperlink directed workers to a web page that mimicked an actual Twilio sign-in web page, permitting hackers to gather the knowledge workers inputted there.
After it turned conscious of the breach, Twilio labored with US cellphone carriers to close down the SMS scheme and likewise had website hosting platforms take down the phony sign-in pages. Regardless of this, Twilio says that hackers managed to swap to new internet hosting suppliers and cell carriers to proceed their marketing campaign.
“Primarily based on these components, now we have motive to consider the menace actors are well-organized, subtle and methodical of their motion,” Twilio provides. “Socially engineered assaults are — by their very nature — complicated, superior, and constructed to problem even essentially the most superior defenses.”
Twilio’s working with legislation enforcement to seek out out who’s accountable for the marketing campaign and says it additionally heard from firms that “have been topic to comparable assaults.” Twilio has since shut down entry to the compromised worker accounts and also will alert any prospects affected by the breach.
Social engineering is changing into an more and more frequent tactic for hackers. Earlier this 12 months, a report from Bloomberg revealed that each Apple and Meta shared information with hackers pretending to be legislation enforcement officers. Final 12 months, a hacker tricked a Robinhood customer support consultant into disclosing the knowledge of over 7 million prospects.