New PhaaS Kits Use Voice to Bypass MFA at Google, Microsoft, and Okta

A sophisticated evolution in phishing-as-a-service (PhaaS) offerings: custom kits specifically engineered to support real-time voice-based social engineering campaigns, or “vishing” attacks.

These tools enable threat actors to synchronize phishing pages with verbal scripts, creating a coordinated assault that defeats traditional MFA defenses targeting Google, Microsoft, Okta, and cryptocurrency platforms.

The distinguishing feature of these kits is client-side scripting that grants attackers real-time control over the authentication flow in a victim’s browser while conducting live phone calls.

This synchronization between the phishing interface and the attacker’s verbal instructions dramatically increases the likelihood that victims will approve MFA challenges or surrender credentials.

According to Moussa Diallo, threat researcher at Okta Threat Intelligence, “Using these kits, an attacker on the phone to a targeted user can control the authentication flow as that user interacts with credential phishing pages noted.

Threat actor’s target to approve push notifications, submit one time passcodes (OTP) or take other actions the threat actor needs to bypass MFA controls.

They can control what pages the target sees in their browser in perfect synchronization with the instructions they are providing on the call. The threat actor can use this synchronization to defeat any form of MFA that is not phishing-resistant.”

Phishing-as-a-Service Kits

The attack sequence typically unfolds as follows:

1. Reconnaissance identifies target users, organizational apps, and IT support phone numbers.
2. Threat actors deploy customized phishing pages and spoof company phone numbers.
3. Victims are directed to phishing sites under false IT security pretenses.
4. Entered credentials are automatically forwarded to the attacker’s command-and-control (C2) infrastructure.
5. The attacker tests legitimate credentials against actual sign-in services to identify MFA challenges.
6. The phishing kit is updated in real-time to present pages matching the MFA prompt type.
7. The attacker verbally instructs the victim to complete the MFA challenge shown on screen.

This real-time control extends to defeating push notification-based MFA. An attacker can instruct a user to expect a push notification, then update the phishing page to display a fabricated push approval interface.

Critically, number matching or number challenge MFA can also be bypassed the attacker simply instructs the victim verbally which number to select or enter.

Market Evolution

These phishing kits operate on subscription or access-based models, democratizing advanced social engineering capabilities.

Earlier kits offered generic targeting of major identity providers and cryptocurrency platforms.

Emerging defenses include live caller verification systems some banks and cryptocurrency exchanges now allow users to verify active calls with authorized representatives through mobile applications before approving sensitive transactions.

The emerging generation introduces bespoke C2 panels optimized for specific targets, with threat actors specializing in vishing expertise and selling access to these tailored services.

Diallo notes this trend reflects the commoditization of vishing expertise itself, with specialized knowledge and tooling increasingly available for purchase on underground markets.

Organizations must prioritize phishing-resistant authentication methods. Okta FastPass and FIDO2 passkeys provide genuine protection against these hybrid attacks, as they cannot be socially engineered via phone or phishing interfaces.

Additional controls include network zone restrictions and tenant access control lists (TACLs) that deny access from anonymous services favored by threat actors. Organizations should allowlist legitimate request origins and deny everything else.

As vishing campaigns become increasingly sophisticated and accessible through PhaaS offerings, defenders face an escalating threat.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.