Common mistakes with Okta Identity Threat Protection

Social engineering and the session hijack

MGM lost $84 million in revenue after Scattered Spider used a 10-minute vishing call to impersonate an employee and gain admin access to Okta and Azure. This social engineering move enabled the deployment of ALPHV ransomware and the encryption of 100 ESXi hypervisors, which disrupted hotel keys and online reservations. The attack halted gambling operations as slot machines went offline and forced the company to deal with lawsuits alleging they failed to implement adequate security measures. They exfiltrated 6 TB of customer information. I believe improper configuration of Identity Threat Protection leaves organizations wide open to the same session hijacking that crippled MGM. Even if you use strong multi-factor authentication, tools like Evilginx act as a reverse proxy to capture the idx cookie and device token (DT) during a legitimate authentication. The user interacts with the real Okta interface and enters valid credentials and MFA codes, yet the attacker silently copies the session token. This allows for session hijacking that bypasses all security controls in minutes.

In recent years, attackers have moved from attacking the authentication ceremony to targeting post-authentication sessions. To succeed, the attacker must compromise another threat surface like the OS, device, browser, or application to pivot to the identity threat surface. When an attacker hijacks a session, they use the stolen cookie to impersonate a valid user without ever needing a password or MFA code. Since the user successfully authenticates through the proxy, the security system sees a legitimate login, which allows the attacker to maintain access using the stolen session cookie without triggering any traditional authentication alerts during the session. Can automated responses prevent a thief who already holds a valid session?

Technical flaws in delegated systems

Administrators often miss subtle vulnerabilities in delegated authentication and privilege management. A flaw in how Okta handles AD/LDAP delegated authentication used Bcrypt to hash a combined string of user ID, username, and password, which allowed attackers to reuse cache keys from prior sessions during high network traffic or server downtime. The Bcrypt cache key flaw proves that even foundational security tools can hide high-impact weaknesses. Organizations using AD/LDAP without MFA faced the highest risk from this issue. This issue primarily affected those with usernames of 52 or more characters.

Privilege escalation also occurs through environment inheritance in privileged binaries. Sudo’s handling of the TZ environment variable allows a local, unprivileged user to supply a malicious TZ value to manipulate authorization windows via CVE-2026-96512. By using extreme POSIX timezone offsets like TZ=XXX24, a user can shift effective policy time by up to 25 hours to make an expired NOTAFTER rule appear valid. This allows an attacker to effectively rewind the clock to regain privileged command execution. An attacker must still meet the rule’s other requirements, and PAM authentication still applies.

Deployment requirements for ITP

Correctly implementing Identity Threat Protection requires specific configuration steps to detect changes in the originating client IP. You must identify the originating client IP and configure the proxy service to include that IP in the X-Forwarded-For HTTP header. You also need to update the Trusted proxy IPs section with an active IP zone to include these proxy IP addresses.

To maximize protection, you should integrate Okta Verify with a supported endpoint detection and response solution like CrowdStrike Falcon or Windows Security Center. This integration allows the system to ingest risk scores and use device signals for policy re-evaluation when a change in device context occurs. Ensure you use Okta Verify version 7.26 or later for Android and version 9.9 or later for iOS.

You should also configure an IP exempt zone to allow traffic from specific gateway IPs irrespective of Okta ThreatInsight configurations or blocked network zones. This prevents legitimate traffic from being blocked by automated risk decisions. Administrators can also use Universal Logout to terminate all active Okta, web, and native app sessions across a user’s devices. When the system identifies a risk, administrators can trigger an automated response like terminating a session or prompting users for MFA through Okta Workflows.