Threat actors attributed to the recent Okta compromise have launched a massive phishing campaign which has affected several organizations over the past few weeks. This campaign, tracked as 0ktapus, explicitly targeted multiple organizations with malicious SMS phishing messages aiming to lure victims to visit a website which would harvest their credentials and two-factor authentication (2FA) codes. As of August 26, 2022, there were a total of 9,931 corporate accounts harvested from this phishing operation across the 136 organizations. 0ktapus has targeted multiple countries, including the United States (114 organizations), India (4 organizations), Canada (3 organizations), and Sweden (2 organizations). Data harvested by this campaign is exfiltrated to the threat actors’ Telegram where attackers have the capabilities to access the employee’s organization and exfiltrate data to command-and-control (C2) servers. All the embedded domains utilized by these actors had some sort of multi-factor language (i.e., sso, vpn, okta, mfa, etc.) built into the naming structure of the domain alongside a very simple yet convincing login portal. With phishing campaigns continue to become more prevalent within the threat landscape, CTIX continues to urge the importance of validating the integrity of any correspondence before downloading any documents or visiting URLs to lessen the risk of threat actor compromise.