Okta details 'Work Panel', a turnkey SaaS platform for vishing crews

Identity provider Okta's Threat Intelligence said it has obtained an inside look at a new criminal operator console that packages everything a voice-phishing crew needs into a single, software-as-a-service dashboard.

The platform, dubbed Work Panel by its author, automates domain registration, brand cloning and site hosting for vishing campaigns targeting customers of multiple identity providers, including Okta, Microsoft 365 and Salesforce.

Okta Threat Intelligence researcher Moussa Diallo wrote in an analysis that Work Panel turns what used to be hours of manual infrastructure work into a handful of button clicks.

Diallo said that based on Work Panel's design system, the console is likely to be vibe-coded or built with substantial artificial intelligence assistance for faster shipping and maintenance, by one person.

"The features it ships with are the features a SaaS product team would build if they were building a CRM [customer relationship management] for vishing crews," Diallo wrote.

Work Panel appears to be a very polished product with different access roles, including one for crew management, specialised workflows, audit logging, secrets rotation and a "self destruct" button to quickly end and delete vishing operations.

It provides infrastructure automation using Cloudflare for domain name system (DNS) zones, NiceNIC to buy domains, a dedicated Caddy web server set up as a reverse proxy, with the Bunny content delivery network (CDN) handling click redirect hosts for emails.

Operators can integrate their application programming interface (API) keys for RocketReach, a legitimate commercial contact-data service, with Work Panel.

Vishers can use the RocketReach functionality to get employee names, direct phone numbers, job titles and LinkedIn profiles for a target company domain.

Pasting a genuine Okta sign-in link into the panel automatically pulls a target company's logo, colours and tenant domain, with a similar feature being available for Microsoft corporate email addresses.

Vishing campaign operators can observe the actions of their targets with Work Panel.

When a target enters a password or approves a multifactor authentication (MFA) prompt on the phishing page, the data flows straight to the manager's session queue rather than the vishing caller's screen.

The manager can then watch that queue in real time, using a "push" button to advance each target through a fixed set of phishing pages, a push notification screen, a number-matching prompt, an authenticator code request, while the caller talks them through it on the phone.

Captured usernames, passwords and MFA codes appear in a session panel next to the queue, and a connected Telegram bot can push a copy of the haul to the manager within seconds.

Okta did not reveal how it obtained Work Panel, saying only that it arrived "from a sensitive source".

Vishing has been used by groups connected to The Com online crime community such as Scattered Spider and Scattered Lapsus$ Hunters to target large enterprises to devastating effect.

In July 2025, Qantas was targeted via a call centre in Manila, the Philippines, by vishers who eventually succeeded in capturing information on over five million airline customers.