“The group then used their access to Twilio to attack at least 163 of its customers.”
Five men aged 20 to 25 face charges for SMS phishing that hit LastPass, MailChimp, Okta, T-Mobile and Twilio. The server behind the phishing kit leaked its developer’s Telegram handle, which led to a Gmail address and a 25-year-old in North Carolina. Another suspect allegedly paid for phishing domains with crypto stolen from a victim company. The one-time passcode texted to a phone was the security, and kids in their twenties walked straight through it.