Known malicious kitcriticalphishing
ShinyHunters Okta PassToken
family: okta-passtoken
Short link:scanmalware.com/h/1
Okta-themed brand-impersonation phishing kit. Landing URL has the ?passtoken=&redirect=/ signature; backend.php polls for MFA-bypass state; pingServer heartbeat; Telegram-channel credential exfiltration. Attributed to the ShinyHunters cluster.
Anchors
Provenance
Added: 2026-05-26 12:28
Matches pages that load this exact client script (same file or same code structure). Seeded from a byte-identical script on henryscheinsso.com and servicenowsso.com. The other rows in the okta-passtoken family match the kit's landing URL signature and domains reported for this group, which catch deployments where this script differs or did not load.