okta-attack

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include explicit attacker-controlled domains and URL tampering/open-redirect patterns (e.g. userinfo @host, subdomain typosquatting, redirect params, fragment/backslash obfuscation) that are high-risk for auth-code theft, phishing, or hosting/distributing malicious payloads.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is explicit operational offensive guidance for discovering Okta tenants and performing user enumeration, credential-stuffing/password-spray, MFA abuse (push bombing), phishing/AiTM, redirect/SAML/OIDC exploitation, and post-compromise admin API use—facilitating unauthorized access and data exfiltration.