Red Canary, a leading provider of SaaS-based security operations solutions, announced it has closed its $81 million Series C financing.

Okta's threat hunters say AI has put old identity attacks on fast forward, and the fix starts at enrolment. Alex Zaharov-Reutt, Global AI and Technology Editor | Published 25 Sept 2026 At Oktane 2026 in Las Vegas, Okta's threat intelligence team walked media and analysts through vishing kits steered in real time, AI accounts farmed and resold on Telegram, and North Korean job candidates who send a stand-in to the interview. The attacks are familiar. The speed, scale and polish are new. Most of the attacks Okta's threat intelligence team is chasing in 2026 would've looked familiar to a security analyst a decade ago. Phishing, credential stuffing, fraudulent sign-ups, fake job candidates. What's changed is the throughput. "What we have mostly seen is that AI has changed the speed and scale of known forms of attack," Okta VP of threat intelligence, Brett Winterford, told a roundtable of media and analysts at Oktane 2026. "The volume is so much bigger, and the level of capability that every individual actor has is substantially higher, because they have access to tools that can help them dramatically move faster, explore different methods, [and] identify misconfigurations in a customer environment that they can exploit," Winterford said. Over about 35 minutes, Winterford and three directors from his team took the room through what that looks like on the ground. The fixes they kept coming back to were unglamorous: phishing-resistant authentication, tighter enrolment and recovery, and a security team that actually talks to HR. Who's watching the front door Winterford will be a familiar name to plenty of iTWire readers. According to his Okta Security bio, he was editor-in-chief of iTnews, then held senior security roles at Symantec and the Commonwealth Bank, and served as Okta's regional chief security officer for Asia Pacific and Japan. His team has grown over the past 12 months, and three of the new faces were on the panel. Okta director of threat intelligence, Jeremy Kirk, is a Sydney-based former technology journalist who reported for IDG News Service and ISMG before moving into intelligence analysis at Intel 471. He joined Okta this year. Okta cybersecurity researcher, Mathew Woodyard, came to Okta from threat intelligence shop Bad Packets and then Auth0, where Winterford said he was responsible for "a lot of attack protection features". Woodyard focuses on customer identity and access management (CIAM) and co-authored Okta's 2025 Customer Identity Trends Report. Okta threat intelligence leader, Katie Nickels, previously led intelligence, research and hunting teams at Red Canary and was the threat intelligence lead for the MITRE ATT&CK team. She also teaches the SANS FOR578 cyber threat intelligence course, and she's one of the team's newest additions. The team's day job is what Winterford calls the front door. "The identity provider is typically the front door for a lot of attacks," he said. Okta recently sent its 10,000th suspicious domain notification to a customer, warning that a newly registered domain looked like the setup for a social engineering campaign against them. It sent 736 of those in July 2026 alone, and it also alerts customers when their users interact with phishing infrastructure. The stat the team is proudest of comes from Okta director of cyber threat research, Tim Peel. He wrote that 83% of the indicators Okta confirmed as malicious "were not previously detected anywhere else". Only 3% had been flagged by more than four other sources. The enemy behind the lines Watching the front door only helps with attacks that pass through it. Plenty don't. That's where Okta's newest acquisition comes in. Okta announced it would buy Permiso Security on 30 July and closed the deal on 26 August. It didn't disclose the price, but TechCrunch cited a source putting it at just under US$200 million, almost all cash. "If we're focused on the enemy at the gates, they're looking at the enemy that slips behind your lines," Winterford said. Permiso watches what happens after sign-in across cloud and SaaS environments, using what Okta says are "more than 2,500 research-driven signals across 70+ identity partners". Winterford said it has "a huge detection library" for attacks "that often don't transit the identity provider at all. So we would have no signal, and they would have that." Permiso's research arm, P0 Labs, is led by Permiso CTO, Ian Ahl, a former head of advanced practices at Mandiant. Winterford said the deal brought "a whole bunch of analysts and former Mandiant folks" into the fold. It's one more move in a busy stretch for identity security deals. Okta picked up privileged access startup Axiom Security in August 2025, and Palo Alto Networks closed its CyberArk acquisition, a deal worth roughly US$25 billion, in February. Same attacks, far more of them Winterford's broad read is that AI has changed "the scale of activity that we are observing, and the speed at which adversaries are moving" over roughly the last 12 months. Other vendors' numbers point the same way. CrowdStrike's 2026 Global Threat Report found AI-enabled adversaries increased operations by 89% year on year, and average eCrime breakout time fell to 29 minutes, with the fastest at 27 seconds. Palo Alto Networks' Unit 42 2026 Global Incident Response Report found identity weaknesses were exploited in 89% of its investigations, and identity-based techniques drove 65% of initial access. (Two different 89% figures from two different reports is a coincidence, but a handy one to remember.) The operator in the loop The research Winterford has been most focused on lately is a pattern Okta calls "operator in the loop" phishing. He admitted the team quite likes the name. "You have a caller, somebody who's a social engineer, on the phone to a target," he said. "You have someone running phishing pages that are actually pushing a selection of phishing pages to the target's browser." As the victim hands over credentials, "another operator is then typing them into the real resource, and then depending on what MFA challenge is made available to them, that will then push a different page to the target user's browser," Winterford said. The victim gets a phone call and a web page that match each other perfectly. The attacker typically ends up registering their own authenticator and helping themselves to protected resources. Okta first documented these kits in January in Phishing kits adapt to the script of callers. Okta threat researcher, Moussa Diallo, wrote that the synchronisation lets an attacker "defeat any form of MFA that is not phishing-resistant", and that includes push notifications with number matching. At the time, Winterford told CyberScoop the team had seen multiple kits built for voice phishing operators, "each with dedicated panels for impersonation of Google, Microsoft and Okta sign-in flows, as well as cryptocurrency providers." In July, Diallo pulled apart a vishing platform called Work Panel, which splits the job into caller, manager and admin roles. Callers make the calls but never see the credentials they help capture. Managers watch a live queue of compromised browsers and hit a "Push" button to move each victim to the next page. According to Diallo, underground ads recruit "fluent English-speaking callers", paid per successful capture. (It's a call centre, basically, complete with a KPI dashboard and a staff turnover problem.) Google's Threat Intelligence Group tracked the same style of attack in January under the brand [Redacted]. Clusters it calls UNC6661, UNC6671 and UNC6240 phished SSO credentials and MFA codes, then stole data from Salesforce, SharePoint, Slack, DocuSign and Google Workspace. Google stressed the activity wasn't the result of any vendor vulnerability. CrowdStrike's 2026 Threat Hunting Report says vishing intrusions doubled in the first half of this year, and device code phishing attempts jumped 15 times over. Australians have already seen how this ends. The Qantas breach in mid-2025 started when a caller persuaded an airline contact centre agent to connect a modified version of Salesforce's Data Loader to its customer system, iTnews reported. The Office of the Australian Information Commissioner puts the number of affected Australians at about 5.12 million (Qantas' own figure was 5.7 million customers globally). In July, the OAIC decided it wouldn't open a formal investigation, though it can still do so later. Passkeys, and no fallback Winterford didn't soften Okta's response. "We are on an absolute warpath at the moment, and we're having to convince our customers to double down on phishing-resistant authentication," he said. That means Okta FastPass and passkeys, enforced in policy for every resource an organisation cares about, with no route back to weaker factors. "Don't let them fall back to weak and vulnerable authentication, because these skilled social engineers, that's what they're trying to convince the users to do," Winterford said. Attackers have already worked out where the soft spots are. In July, Winterford wrote that one in five of Okta's proactive notifications over the previous month involved phishing domains containing the string "passkey". Another cluster Okta tracks, O-UNC-067, skips credential phishing altogether. It triggers a self-service password reset and then talks the victim through approving it on the phone. So Okta's advice now covers enrolment and recovery too: require a phishing-resistant factor before anyone can add or change an authenticator, and pre-enrol security keys where possible. Microsoft is pushing hard in the same direction. From 1 September, Entra ID started making passkeys the default for users enabled for SMS or voice MFA, and Microsoft will retire its own SMS and voice authentication services on 1 February 2027. Microsoft cites AI-enabled phishing campaigns reaching click-through rates as high as 54%, against roughly 12% for traditional campaigns. The FIDO Alliance said in May there are about five billion passkeys in use, and 68% of organisations have deployed or are deploying them for staff sign-in. CAPTCHAs are a speed hump for AI agents Woodyard's patch is customer identity: the sign-up and sign-in pages businesses put in front of the public. His message was that AI agents have made the basics matter more. "You have to get things right from the beginning. You have to use the right factors," Woodyard said. He walked through how an agent sizes up a target. "Where are the edge controls? I'm going to look at your deployment. Is there a way to bypass multi-factor authentication? Is there a way that I can more effectively do my credential stuffing attack if you have some legacy implementation of passwords as a factor?" Woodyard said. "That really gets to how passwords are an unacceptable factor," he said. The classic trade-off is to add friction, such as a CAPTCHA. Woodyard said attackers now account for that "out of the box", using headless browsers to solve proof-of-work challenges like ALTCHA or Cloudflare Turnstile, or paying CAPTCHA-solving farms. He tested an AI agent locally, with its guardrails in place, to see whether it would have a go at getting past a CAPTCHA. "It actually worked," Woodyard said. "So you always have to assume that that's there." That tracks with what the public saw in July 2025, when OpenAI's ChatGPT agent narrated its way past a Cloudflare Turnstile check. "Now I'll click the 'Verify you are human' checkbox to complete verification on Cloudflare," the agent announced, without a hint of irony. By the time attackers reach a login page, Woodyard said, they've often pre-validated stolen username and password pairs against that specific target. Then they'll route traffic through a residential proxy service "that's going to be less likely to be flagged as high risk". The scale of that proxy market is enormous. When Google disrupted the IPIDEA residential proxy network in January, it counted more than 550 threat groups using its exit nodes in a single seven-day period. Woodyard's conclusion: "Using a factor like a passkey that's phishing resistant, that can't be bypassed, that's easy to register for users themselves, is really non-negotiable." Free tokens and hijacked sessions Kirk's research started with something odd on Telegram. "We saw across Telegram all these services offering Claude subscriptions and OpenAI subscriptions and other models for 70 to 90% off," he said. "We're thinking, well, what's going on here?" The answer, published in August as Free tokens for sale: How fake signups drive AI fraud and co-written with Woodyard, was fraudulent registration at scale. "A lot of AI companies now are offering free credits to attract customers," Kirk said. Fraudsters register accounts in bulk, pool them, and resell access through AI API gateways such as LiteLLM or OpenRouter. One service Okta examined, "Poison Claude", pools accounts funded with AWS's new-account Bedrock credits and charges 5% to 15% of the official per-token price. An exposed API showed 881 users. Another vendor sold ready-made accounts for US$40 in the cryptocurrency Tether. One AI video service logged more than 105,000 brute-force sign-up attempts from 251 IP addresses in a single month. Kirk said there are two kinds of buyer. Some just want cheap AI, and the others are threat actors. "If you're doing something bad with an AI model, you don't want to have to tie it to your own credit card and have the account banned," he said. The services are "provisioned so that if the account gets banned, it rotates to the next one," Kirk said. "There's this constant churn of fresh accounts." Prompts also pass through the reseller's gateway before reaching the AI provider, which he said gives users "a certain level of operational security". Kirk called that the grey market. His second piece of research, published this month, covers what he called "the unambiguously illegal aspect of it": stolen session tokens and API keys. Infostealer malware "sucks everything out of the browser", Kirk said, and it's now specifically hunting for API keys in AI model configuration files. "If you have secrets in those configuration files, they will steal those." For Signing in without actually signing in, Okta analysed a 7GB infostealer dump covering 5,871 infected machines in 162 countries. Here's what it found for the big AI providers: | AI provider | Unique session tokens | Still unexpired | | Google | 9,829 | 9,213 | | Microsoft | 2,491 | 1,763 | | Anthropic | 561 | 164 | | Amazon | 349 | 254 | The write-up cites one company hit with nearly US$1 million in fraudulent charges and a software architect handed a US$25,000 bill. (Anyone who's been stung by a runaway cloud instance will feel that one in the stomach.) Kirk said Anthropic had started automatically logging people out when it detected session hijacking, and stripping saved payment details from affected accounts. Anthropic confirmed on 30 August that a bad actor was using common infostealers, including Vidar, LummaC2, StealC, RedLine and Atomic Stealer, to hijack Claude sessions "and consume their usage". It signed affected users out, removed saved payment methods and refunded unauthorised charges. "They're recognising that this can be a very effective and very expensive attack vector," Kirk said. Anthropic's own September threat report describes stolen credentials as loot, compute and cover: they have resale value, they let attack workloads run "at someone else's expense", and the activity gets pinned on the legitimate owner. It also describes a reseller whose "discounted Claude access" was quietly routed to a different AI model while its tooling installed a credential harvester. Sysdig coined the term LLMjacking back in 2024. Two years on, it has its own supply chain. Okta's advice includes short-lived OAuth access tokens, device-bound session credentials where supported, usage caps and IP allowlisting on API keys, secret scanning to keep keys out of plaintext config files, and detection for session token reuse. North Korea has company Nickels has spent her first stretch at Okta on the problem long known as North Korean IT workers. "You might be saying, why are we still talking about this? It's still happening quite a bit," she said. Okta increasingly calls it "workforce infiltration", Nickels said, because actors from Pakistan, India and Russia have joined in. North Korea's operators "are still the big players in the game", she said. She cited an estimate of about US$800 million a year flowing to the regime, "funnelled into nuclear weapons research". That's the same figure the Wall Street Journal used in its August documentary, The North Korean Operatives Hiding Inside U.S. Companies. A multilateral sanctions monitoring team puts North Korea's overseas labour earnings at US$450 million to US$800 million in 2025, iTnews reported. "They've really industrialised this at scale," Nickels said. "If there's one little thing that maybe is a tell somewhere in their process, they're going to change that." AI runs through the whole pipeline, from scraping LinkedIn to auto-generating CVs, Nickels said. Okta's September 2025 research, by Okta threat intelligence researchers, Simon Conant and Alex Tilley, tracked more than 130 identities tied to about 6,500 job interviews at more than 5,000 companies. Some 27% of the targeted roles were outside the US, and only about half were in IT. The volume is still climbing. US identity verification startup Endorsed told Fortune that 47% of the remote IT job applications it screened last quarter carried patterns associated with North Korean worker schemes, up from 11% in the third quarter of 2024. Australia is firmly in the frame. Huntress found that three employees of an Australian healthcare company were North Korean workers posing as Chinese nationals. Australia was also one of 11 countries behind a 31 July joint alert warning that North Korean IT workers impersonate other nationalities and use AI tools to obscure their identities. And on 22 September, the Australian Signals Directorate co-signed an advisory on the WaterPlum fake job interview campaign, though it wouldn't confirm any local victims. The stand-in at the interview The detail that got the room's attention was how the more capable crews handled deepfake detection. Face-altering software had become a tell, Nickels said, and interviewers started asking about it. "Some of the smarter, more effective ones have realised that's a tell. How do I get around that? They actually hire Western-based people," she said. These US-based stand-ins, whom she described as "essentially mules", turn up to interviews on the worker's behalf, and may not fully understand what they've signed up for. So how do they answer technical questions? "AI," Nickels said. "A lot of the actors will actually go to their chatbot of choice and type the question right in there. They read it word for word quite often." Handlers also coach them ahead of time. Woodyard, speaking from his own hiring experience since the pandemic pushed interviews online, said stand-ins may also have "somebody else in their ear giving the answers", which explains the lag. "They're waiting for what their handler is telling them to say." Winterford pointed to Okta's April 2025 research, which found DPRK operatives testing AI mock-interview services that critique their "lighting, video filters, and conversation approach". "It's incredible to me to think that 18 months ago, that particular field had more efficient uses of AI tools than anyone on our side," Winterford said. He also made a fair point about hindsight. Watch the footage knowing it's a fake and everything looks suspicious. A third-party recruiter racing to fill a quota doesn't get that head start. "These guys go after contracting houses for a reason," Winterford said. The US Department of Justice keeps stacking up cases. In April, two New Jersey men who ran laptop farms were sentenced to 108 and 92 months in prison. Their scheme hit more than 100 US companies, used at least 80 stolen identities and raised over US$5 million for North Korea. Talk to your hiring team Nickels' fix is cheap, and it's cultural. Security teams tend to look at the logs they can see, she said, but "this workforce infiltration threat is something that is going to require hiring teams to work with security, to work with IT, to work with legal." Start with notes. "Companies will say, 'Oh yeah, everyone takes notes from interviews.' Then they go and look; there are no notes," Nickels said. Train interviewers to write down what feels off: long pauses, background typing, a robotic voice, hesitation on follow-up questions, a face that looks altered. Junior staff in particular are often reluctant to put "the vibes are off" in writing, she said. Then there's the simplest trick of the lot. "At the start of any virtual interview, take a screenshot of the candidate's face," Nickels said. These crews run "thousands and thousands of personas", she said, and often send different people to interviews at the same company. A screenshot makes it much harder for one stand-in to quietly cover for another. Third-party recruiters are the soft underbelly. "Sometimes their background checks might consist of reading a LinkedIn profile. LinkedIn is not a way to verify," Nickels said. Her example: a crew copies an impressive developer's LinkedIn profile into a CV, swaps in its own email address and phone number, and applies. The recruiter checks LinkedIn, maybe even rings the university, and everything lines up. Every email and phone call then goes straight to the criminal. She recommends proper identity document verification through providers such as Persona, and a hard look at how third-party hiring partners verify candidates. "If they know that hiring team doesn't talk to security or IT, they can take advantage of that. Those are the cracks they're getting through," Nickels said. Asked about motives, Nickels said Okta has so far only seen financial motivation from the newer, non-North Korean actors. "It'd be silly not to think that they're using them for other purposes. We just haven't seen direct evidence of that," she said. Australian businesses have a legal wrinkle to consider as well. The Australian Sanctions Office's guidance on DPRK IT workers says any business that suspects it has hired one should contact the office and "suspend all future payments until further direction". What's in a name One attendee asked whether catchy threat actor names hand criminals free PR. Winterford, who spent years writing headlines himself, can see both sides. Okta gives its clusters deliberately dull designations such as O-UNC-045, and "sometimes our customers are like, 'Can you please just tell me, is that [Redacted]?'" he said. He'd rather starve the brand of oxygen. [Redacted] "is a term that is used to strike fear into the heart of someone who's having to decide whether to pay an extortion demand or not," Winterford said. "Why should we be using their marketing terms?" The catch is that executives need a shared language, and the options are often names the attackers picked themselves, or ones a cyber security vendor has, as Winterford put it, "created an action figure" around. Internally, Winterford said, Okta clusters activity very precisely, usually around attacker infrastructure, and accuracy comes first. Sometimes the team learns years later that two separate designations were "a blend of only three or four individuals". The naming mess is real. The group Okta tracks as O-UNC-045 is CrowdStrike's CORDIAL SPIDER and Google's UNC6671, according to The Hacker News. Microsoft and CrowdStrike started building a shared "Rosetta Stone" of actor names in June 2025, with Google and Unit 42 joining, for exactly this reason. Nickels, who spent years shaping how the industry classifies adversary behaviour at MITRE ATT&CK, said names are useful shorthand. "It's easier for people to remember Scattered Spider," she said. What defenders care about is simpler. "They want to know, am I impacted? How do I protect [myself]?" Nickels said. "I always say, if we're going to share something that's a little bit scary about a threat, pair that with remediation," she said. "Explain what they do and then how customers can protect themselves." Assurance is the whole game The last question came from Info-Tech Research Group analyst, Carlos (he gave only his first name), who asked how organisations should build programs for remote hiring and onboarding, citing NIST's identity assurance levels. Winterford said assurance ties the whole session together. "That is the measure of what we're trying to achieve: having assurance in someone, that someone is who they claim to be," he said. "Particularly at key moments, like when you first employ someone, when you interview them, when they enrol." "We focus so much on the sign-in flow, and we don't focus enough on enrolment," Winterford said. For some organisations, that could mean going back to in-person onboarding. "For some employees, it might be we only do physical onboarding from now on," he said. For organisations spread too widely for that, Winterford suggested running identity verification repeatedly through recruitment and watching for changes. Those services check device and location signals in the background, so a mismatch partway through the process is a reason to look closer. NIST's SP 800-63A-4, finalised in August 2025, now says identity proofing providers "SHALL implement technical controls to increase confidence that digital media is being produced by a genuine sensor". That's aimed squarely at injected video and deepfakes. What Australian organisations should take from this * Enforce phishing-resistant authentication, such as passkeys or Okta FastPass, for sign-in, enrolment and recovery, and close off any fallback to SMS, voice, push or one-time codes for anything that matters. * Treat self-service password resets and help desk resets as attack surface, because the vishing crews certainly do. * On public sign-up pages, assume CAPTCHAs will be solved. Layer on bot protection, registration policies and passkeys. * Keep API keys out of plaintext config files, set usage caps and alerts, and watch for session tokens being replayed from somewhere new. * Get security, HR, IT and legal in the same room. Take interview notes, grab a screenshot at the start of every video interview, train interviewers, verify ID more than once, and ask recruiters exactly how they check candidates. * If you suspect you've hired a North Korean IT worker, contact the Australian Sanctions Office and stop paying them. The attackers have scaled up with AI. The most effective counters the panel offered cost almost nothing: a screenshot, a set of notes and a phone call to HR. (A proper passkey rollout costs a bit more, admittedly. Probably less than a Qantas-sized breach, though.)