Twilio employees received smishing SMS impersonating IT dept claiming password expiry. Employees entered credentials on fake Twilio login page with real-time MFA relay bypassing TOTP. 209 Twilio customers and 93 Authy users affected. Part of larger ‘0ktapus’ campaign hitting 130+ organizations including Cloudflare, DoorDash, Signal (via Twilio). Attackers had sophisticated employee phone-to-name matching. Also revealed Twilio was breached earlier in June 2022 via same method.