Okta says it is facing unprecented levels of attacks

Identity and access management company Okta says it is facing an “unprecedented” scale of credential stuffing attacks, looking to breach user accounts of its online services.

Credential stuffing is a type of cyberattack in which threat actors use a previously obtained username/password list and “stuff” them into different services, to see if they can gain access.

It’s basically just trying out different combinations, but by using automation the process is incredibly fast and the attackers can try hundreds of combinations in minutes. The login credentials are usually purchased off the black market in advance.

Mitigations at the edge

Okta suspects that whoever is behind this campaign has also done the same against Cisco’s VPN services earlier this year, as the same infrastructure was used. In all of the attacks, the requests came from the TOR anonymization network as well as different residential proxies.

While ...