Twilio Social Engineering Attack

Twilio Social Engineering Attack

Product Serial: F-2022-08-08b

TLP: WHITE

In this flash report, ZeroFox Intelligence shares potential implications of a recent targeted campaign to collect credentials from current and former Twilio staff credentials.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full flash report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 1:00 PM (EDT) on August 8, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

ZeroFox Intelligence is monitoring an incident involving Twilio, which confirmed that hackers accessed its customer data after a successful smishing campaign. Twilio announced publicly today that the campaign targeted current and former employees with fraudulent SMS messages claiming to be from Twilio's IT department and stating that the users' passwords had expired. The attackers were then able to use the stolen credentials to gain access to internal systems and, subsequently, to certain customer data. Twilio is contacting all affected customers as of this writing.

Key Findings

• Enterprise software vendor Twilio confirmed today that hackers accessed an undisclosed amount of its customer data after an SMS phishing (smishing) campaign.
• Twilio began contacting users impacted by the attack.
• Nevertheless, ZeroFox Intelligence recommends that Twilio users change their account login credentials and enable two-factor authentication if possible.