Same phishing texts, two different endings
Twilio and Cloudflare were hit by the same SMS phishing campaign. Hardware security keys made the difference.
This month two companies told the same story with different endings.
Twilio said employees received text messages pretending to come from its IT department, with links to a fake login page. Some entered their details, and the attackers reached data for some customers.
Cloudflare got the same kind of texts at almost the same time. Three employees entered their username and password on the fake page. Nothing happened, because Cloudflare requires hardware security keys to log in, and those keys won’t work on a fake domain.
Same attack. Same human mistake. The difference was the type of MFA.
Codes by SMS or app can be typed into a phishing page, and the attacker uses them right away. Security keys and other FIDO2 methods check the website’s real address before they answer.
What I’d do:
- Start with admins, finance, support and engineers: give them security keys.
- Buy two per person, one as a backup.
- Plan the rest of the company next.
Cloudflare also praised the employees who reported the texts quickly. Both matter.