PhishingReviewed
Dataminr: riskified-okta.com and shipmonk-servicenow.com host fake Okta logins with a YubiKey MFA-downgrade lure; gladly-okta.com linked
Dataminr says riskified-okta.com and shipmonk-servicenow.com hosted fake Okta logins with a YubiKey MFA-downgrade lure; gladly-okta.com, found a day later, matches the theme. Okta, ServiceNow and the named firms are impersonated.
- riskified-okta.com
- Also gladly-okta.com and shipmonk-servicenow.com (Dataminr TRACE IOCs, Oct 18-19, 2026)
Reported Oct 19, 20261 report