Okta warns that a Customer Identity Cloud feature is being targeted in credential stuffing attacks, stating that numerous customers have been targeted since April.
Okta is a leading identity and access management company providing cloud-based solutions for secure access to apps, websites, and devices.
A credential stuffing attack is when threat actors create large lists of usernames and passwords stolen in data breaches or by information-stealing malware and then use them to try and breach online accounts.
Okta says it identified credential stuffing attacks starting on April 15, 2024, which targeted endpoints utilizing Customer Identity Cloud's cross-origin authentication feature.
Okta's Cross-Origin Resource Sharing feature allows customers to add JavaScript to their websites and applications to send authentication calls to the Okta API hosted.
For this feature to work, customers must grant access to the URLs from which cross-origin requests can originate.
Okta states these URLs are targeted in credential stuffing attacks and should be disabled if they are not in use.
The company has notified customers targeted in these attacks with remediation guidance on securing their accounts.
BleepingComputer contacted Okta to ask how many customers have been impacted by the credential stuffing attacks.
Okta recommends that admins check logs for 'fcoa,' 'scoa,' and 'pwd leak' events that indicate cross-origin authentication and login attempts using leaked credentials.
If cross-origin authentication isn't used on the tenant but 'fcoa' and 'scoa' are present, this indicates you're targeted by credential stuffing attacks.
If cross-origin authentication is used, look for abnormal spikes in 'fcoa' and 'scoa' events.
As the suspicious activity started on April 15, Okta recommends that customers review logs from that point in time.
Rotate compromised user credentials immediately Implement passwordless, phishing-resistant authentication, with passkeys being the recommended option.
Enforce strong password policies and implement multi-factor authentication.
Remove permitted cross-origin devices that are not in use.
Restrict permitted origins for cross-origin authentication if necessary.
Enable breached password detection or Credential Guard, depending on the plan.
Customers needing further assistance can reach out to Okta's Customer Support or its community forums.
LockBit says they stole data in London Drugs ransomware attack.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 29 May 2024 15:50:03 +0000