Sophisticated Okta SSO Phishing Bypasses Defenses to Steal Session Tokens With Salary Review Lures

According to Datadog Security Labs, a sophisticated phishing operation active since early December 2025 targets organisations relying on Microsoft 365 and Okta for Single Sign-On, using envelope-pushing techniques to bypass security controls and steal session tokens.

Victims receive emails that mimic HR or payroll notifications, with subject lines such as “Action Required: Review Your 2026 Salary & Bonus Information” or “Confidential: Compensation Update,” and some attacks include encrypted PDF attachments protected with a password in the email body.

The campaign stands out for its proxy system that interacts with the real Okta login page, and for a malicious script that monitors browser traffic to detect FederationRedirectUrl, then redirects from a fake Microsoft page to a fake Okta page. Once credentials are entered, a script named inject.js captures keystrokes and, more importantly, searches for critical cookies such as idx, JSESSIONID and sid to exfiltrate session tokens via a POST to the attacker’s server. The attackers are also using Cloudflare turnstiles to hide the malicious sites from security bots while continually refining their code.