Key Takeaways
- Dataminr TRACE has identified a phishing campaign that registers Okta and ServiceNow-themed domains to impersonate SSO portals for B2B e-commerce and SaaS providers.
- The campaign pairs fake Okta login pages with an MFA downgrade lure targeting YubiKey users, allowing attackers to bypass hardware-based MFA where policy permits fallback methods like SMS or email codes.
- Targeting is concentrated on e-commerce infrastructure providers, likely because compromising these providers creates leverage for downstream third-party breaches and data extortion.
Background
Since late July 2026, Dataminr TRACE has observed several waves of malicious domain registration activity linked to English-language cybercrime entities. These domains are typically SSO or enterprise SaaS-themed, and used to support voice phishing (vishing attacks.
Vishing attacks are a highly effective form of social engineering. Traditional vishing might come in the form of an attacker posing as a member of the target organization’s IT security team offering help after an MFA fatigue (also known as MFA bombing) attack. More advanced vishing attacks can leverage AI tools to take a clip of an executive’s voice and pretend to be that executive when calling the employee, which creates a high-pressure situation for the target individual.
On October 18, 2026 as part of continuous research and monitoring, TRACE identified activity on two domains of interest. These domains are associated with previous activity assessed to be a campaign targeting multiple B2B ecommerce solutions via organization-branded phishing domains impersonating SSO portals.
Findings
On October 18 2026, Dataminr TRACE identified the following domain registrations:
- riskified-okta[.]com
- shipmonk-servicenow[.]com
Analysis of these domains confirmed the presence of fake Okta login portals. Also present was an MFA downgrade lure targeting users who rely on YubiKey for MFA. This activity aligns with previous public reporting by Okta and is an interesting evolution threat actor tradecraft. Historically, Yubikeys and similar solutions were seen as a difficult blocker for credential-based initial access. However, by leveraging MFA downgrade as a tactic, adversaries can circumvent these solutions where policies allow.
Around 20 hours later on 19 October, 2026, an additional domain matching the theme was identified:
- gladly-okta[.]com
These recently registered domains are assessed with high confidence to be linked to previous phishing activity with similar targeting patterns across the following domains:
- yotpo-okta[.]com
- paddleokta[.]com
- moengageinc-okta[.]com
- vzw-web-portal[.]com
- listrak-okta[.]com
- oktadialpad[.]com
- servicenow-ticket2478[.]com
- servicenow-ticket2829[.]com
- servicenow-ticket[.]com
- attentive-okta[.]com
Activity observed since September 2026 displays a targeting pattern focused on ecommerce SaaS and infrastructure organizations. Targeted organizations include marketing and customer engagement platforms, logistics partner, payment, and fraud prevention providers. Several organizations were targeted multiple times. Two outlier domains include vzw-web-portal (potentially targeting Verizon or Verizon-provisioned services) and multiple ServiceNow domains. The latter is likely a target-agnostic lure that could be used against multiple organizations, potentially through crafted subdomains targeting specific entities.
This recent trend targeting e-commerce solution providers is likely due to the potential for downstream third-party breaches, which would increase leverage for data extortion.
Recommendations & Immediate Actions
- Block access to the identified domains, and search for end user interaction with these domains prior to placing the block.
- Audit SSO logs for successful authentications from unexpected IPs associated with VPN and proxy services, MFA device enrolment or changes shortly after sign-on, and abnormal device fingerprints.
- Audit and understand current MFA policies, and residual risk in place when alternative mechanisms (e.g., SMS or email code is provided as an emergency backup when hardware keys are lost), to understand and potentially investigate downgrade attack possibilities.
- Educate employees on modern social engineering tactics and ways to identify potential threats. Run periodic tests to help them practice how to recognize and report suspicious activity.
IOCs
- gladly-okta[.]com
- riskified-okta[.]com
- shipmonk-servicenow[.]com
- yotpo-okta[.]com
- paddleokta[.]com
- moengageinc-okta[.]com
- vzw-web-portal[.]com
- listrak-okta[.]com
- oktadialpad[.]com
- servicenow-ticket2478[.]com
- servicenow-ticket2829[.]com
- servicenow-ticket[.]com
- attentive-okta[.]com
2026 Mid-Year Cyber Threat Landscape Report
The first half of 2026 was defined by a widening gap between attack speed and defense speed — and AI is accelerating both sides. Dataminr’s 2026 Cyber Threat Landscape Mid-Year Report pulls from 4,500 threat actors tracked, 73,000 vulnerabilities detected, and over 2 million alerts processed per month to surface what actually mattered in H1 and what teams need to prepare for in H2.
Download Report
