Digital communication platform Twilio was hacked after a phishing campaign tricked its employees into revealing their login credentials (via TechCrunch). The firm disclosed the data breach in a post on its blog, noting that solely “a limited number” of buyer accounts were affected by the assault. Twilio permits internet providers to ship SMS messages and place voice calls over phone networks and is used by firms together with Uber, Twitter, and Airbnb.
The hack occurred on August 4th and concerned a dangerous actor sending SMS messages to Twilio employees that requested them to reset their password or alerted them to a change of their schedule. Each message included a hyperlink with key phrases, like “Twilio,” “SSO” (single sign-on), and “Okta,” the identify of the consumer authentication service used by many firms. The hyperlink directed employees to a web page that mimicked a actual Twilio sign-in web page, permitting hackers to gather the knowledge employees inputted there.
After it grew to become conscious of the breach, Twilio labored with US telephone carriers to close down the SMS scheme and in addition had hosting platforms take down the phony sign-in pages. Despite this, Twilio says that hackers managed to swap to new internet hosting suppliers and cellular carriers to proceed their campaign.
“Based on these factors, we have reason to believe the threat actors are well-organized, sophisticated and methodical in their action,” Twilio provides. “Socially engineered attacks are — by their very nature — complex, advanced, and built to challenge even the most advanced defenses.”
Twilio’s working with legislation enforcement to search out out who’s answerable for the campaign and says it additionally heard from firms that “were subject to similar attacks.” Twilio has since shut down entry to the compromised worker accounts and also will alert any prospects affected by the breach.
Social engineering is turning into an more and more frequent tactic for hackers. Earlier this 12 months, a report from Bloomberg revealed that each Apple and Meta shared data with hackers pretending to be law enforcement officials. Last 12 months, a hacker tricked a Robinhood customer service representative into disclosing the knowledge of over 7 million prospects.