Dataminr: riskified-okta.com and shipmonk-servicenow.com host fake Okta logins with a YubiKey MFA-downgrade lure; gladly-okta.com linked
Dataminr says riskified-okta.com and shipmonk-servicenow.com hosted fake Okta logins with a YubiKey MFA-downgrade lure; gladly-okta.com, found a day later, matches the theme. Okta, ServiceNow and the named firms are impersonated.
- First reported
- Reports
- 1
Source: dataminr.com · published
What happened
In an intel brief dated October 19, 2026, Dataminr's Threat Research and Cyber Engineering team (TRACE) says it identified newly registered phishing domains impersonating single sign-on portals of B2B e-commerce and SaaS providers. On October 18, 2026 it found riskified-okta[.]com and shipmonk-servicenow[.]com, and about 20 hours later, on October 19, gladly-okta[.]com. Dataminr says analysis of the first two domains confirmed fake Okta login portals, along with an MFA-downgrade lure aimed at users who rely on YubiKey hardware keys, which lets attackers bypass hardware MFA where policy allows fallback methods such as SMS or email codes; gladly-okta[.]com was identified as matching the same theme. Dataminr assesses with high confidence that the domains are linked to earlier phishing activity using yotpo-okta[.]com, paddleokta[.]com, moengageinc-okta[.]com, vzw-web-portal[.]com, listrak-okta[.]com, oktadialpad[.]com, servicenow-ticket[.]com, servicenow-ticket2478[.]com, servicenow-ticket2829[.]com and attentive-okta[.]com, and says domains in these registration waves, linked to English-language cybercrime actors, are typically used to support voice-phishing (vishing) attacks. The brand names in the domains belong to the companies being impersonated or targeted (Okta, ServiceNow, Riskified, ShipMonk, Gladly and others); they do not run these sites. Dataminr recommends blocking the domains, checking for prior user interaction with them, auditing SSO logs and reviewing MFA fallback policies.
Background
Dataminr says it has seen several waves of malicious domain registrations linked to English-language cybercrime groups since late July 2026, typically themed on single sign-on or enterprise SaaS and used to support voice phishing. In such calls an attacker may pose as the target organisation's IT security team, for example offering help after a burst of MFA push requests. The MFA-downgrade tactic matters because hardware keys such as YubiKeys were long seen as a strong barrier to credential theft; where policy lets users fall back to SMS or email codes, attackers can get around them. Dataminr says the targeting since September has focused on e-commerce SaaS and infrastructure providers, likely because breaching them creates leverage for downstream data extortion.
Source
Dataminr, "Okta-Themed Phishing Campaign Targets E-commerce Providers" (intel brief, 19 October 2026).
Red flags
- An Okta or SSO sign-in page on a domain that combines a company's name with 'okta' or 'servicenow', such as riskified-okta.com.
- A call from someone claiming to be IT support who sends you to a login page.
- A prompt to use an SMS or email code instead of your security key.
- Unexpected MFA push requests followed by an offer of help.
If you were targeted
- 1Sign in only through your organisation's known SSO address; don't use links from calls or messages.
- 2Never switch from a security key to SMS or email codes because a caller or page tells you to.
- 3If you entered credentials, report it to your security team at once and reset your password and MFA devices.
- 4Admins: block the listed domains, search for prior user interaction with them and audit SSO logs.
- 5Review MFA fallback policies so hardware-key users can't be downgraded without verification.