Cloudflare And Twilio Targets Of A
Sophisticated Smishing Attack

The threat actors that targeted the companies’ employees managed to fool some employees from both companies into providing their credentials.

Twilio, confirmed that the attackers used the credentials to gain access to some of their internal systems, where they were able to access certain customer data.

From what they stated, they worked with the U.S. carriers to shut down the actos and worked with the hosting providers serving the malicious URLs to shut those accounts down.

Twilio’s security team also revoked access to the compromised employee accounts to mitigate the attack and engaged a leading forensic firm to aid their ongoing investigation.

While Twilio is taking remediation steps, Cloudflare, on the other hand, were able to stop the attack while it was running.

They did state that individual employees did fall for the phishing messages but they were able to thwart the attack through use of their Cloudflare One Products and physical security keys that they issued to every employee that are required to access all of their applications.

Every employee at the company is issued a FIDO2-compliant security key from a vendor like YubiKey.

Since the hard keys are tied to users and implement origin binding, even a sophisticated, real-time phishing operation like this one cannot gather the information necessary to log in to any of the Cloudflare systems.