In 2022 the same SMS phishing campaign hit Twilio and Cloudflare within days of each other. Twilio reported unauthorised access to data belonging to around 209 of its roughly 270000 customer accounts. Cloudflare reported that three employees entered credentials on the fake page and that no systems were compromised. What structural difference produced two different outcomes?

The trigger

Text messages impersonating IT, telling staff that a password had expired or a schedule had changed, linking to a convincing clone of the identity provider's login page. Cloudflare reported that at least 76 employees received the messages. Employees at both companies entered credentials. At the human layer, both defences failed, and any analysis that stops at "train the staff" has learned nothing from it.

Why it propagated at one and not the other

The phishing page asked for the password and the time-based one-time code, and relayed both to the operator in real time so they could be used on the genuine login page within the code's validity window. Cloudflare's report also describes the page pushing a download of the legitimate remote access tool AnyDesk, to establish persistence if the login succeeded.

A TOTP code is a shared secret with a short lifetime and no knowledge of where it is being typed. Relaying it is a transport problem, not a cryptographic one, so a real-time proxy defeats it entirely.

Cloudflare did not use TOTP. Every employee had a FIDO2 hardware security key, and the authenticator signs a challenge that includes the origin of the site requesting it. The browser will not produce a signature for example-sso.com that verifies at example.okta.com. There is no secret for the operator to relay, because the response is bound to a domain the operator does not control.

This is the whole difference: one factor can be forwarded by a human, the other cannot be forwarded at all.

Why detection is not the answer here

The window between credential entry and use is seconds. Anomaly detection on login location or device helps at the margin and does not close a gap measured in seconds. The control has to be preventive, which narrows the field to origin-bound authentication.

The structural fix versus the tempting local fix

The tempting fixes are more training, and a stricter SMS filter. Both are worth doing and neither changes the outcome, because the campaign succeeded against trained employees at a security company.

The structural fix is phishing-resistant authentication for every employee and every path into an internal system, with no fallback to a relayable factor. The fallback matters more than the rollout: if a lost key can be replaced by an SMS code from a help desk, the attacker calls the help desk. Registration and recovery have to be as strong as the primary path, which is usually an in-person or manager-attested process.

Alongside it: short-lived session tokens bound to the device, so a stolen session cookie is not a second path around the key.

The general lesson

Rank factors by whether they can be relayed, not by how many there are. Password plus SMS and password plus TOTP are both two factors and both fall to a real-time proxy. Hardware-backed origin binding is a category change, not an increment. In 2022 that distinction was the difference between an incident report about 209 customers and a blog post about an attempt.

When this is the wrong priority

For a 12-person company whose attack surface is a handful of software-as-a-service accounts, enforcing hardware keys on the identity provider covers nearly everything and the wider programme is premature. The cost is real - roughly the price of two keys per person plus a recovery process - and it scales with headcount, so the argument is strongest where the number of employees with access to customer data is large.