Okta Under Siege: Credential Stuffing Attacks Hit Customer Identity Cloud

Okta has alerted customers to a credential stuffing attack exploiting the cross-origin authentication feature in its Customer Identity Cloud. Users are advised to either disable the feature or implement suggested mitigations to stay secure. Check your logs for “fcoa,” “scoa,” and “pwd_leak” events to identify…

3P
Published: May 30, 2024 4:01 pmAdded: May 30, 2024 at 9:11 amAssembled by: The Editor

Hot Take:

Looks like Okta’s Customer Identity Cloud has become the new playground for credential stuffing bandits. If disabling a feature is your main defense strategy, you know things are getting serious. Time to batten down the hatches, folks!

Key Points:

  • Okta is warning customers about a credential stuffing attack targeting its Customer Identity Cloud (CIC).
  • The attack exploits the cross-origin authentication feature in CIC.
  • Okta advises disabling the feature or applying specific mitigations.
  • Key log events to watch for include “fcoa”, “scoa”, and “pwd_leak”.
  • If these events appear in your logs without using cross-origin authentication, a credential stuffing attempt has been made.

Membership Required

 You must be a member to access this content.

View Membership Levels
Already a member? Log in here