Okta Introduces ‘Work Panel’, a Novel SaaS Solution Designed for Vishing Activities
We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!
Transforming Vishing Operations: Okta’s Work Panel
Quick Read
- Okta announces Work Panel, a SaaS platform aimed at voice-phishing activities.
- Automates the processes of domain registration, brand duplication, and website hosting.
- Employs AI for quick setup and upkeep.
- Enables real-time surveillance of phishing targets.
- Features include secret rotation and a “self-destruct” functionality.
- Abused by groups such as Scattered Spider and Scattered Lapsus$ Hunters.
Enhancing Vishing with Work Panel
Identity provider Okta has launched an innovative SaaS platform, the Work Panel, tailored to optimize voice-phishing operations. This latest offering provides cybercriminals with an extensive dashboard that automates functions like domain registration, brand duplication, and website hosting. Aiming at customers from leading identity providers such as Okta, Microsoft 365, and Salesforce, the software improves the efficiency and effectiveness of executing vishing strategies.
The Functionality of Work Panel

The Work Panel, as described by Okta Threat Intelligence analyst Moussa Diallo, delivers a set of functionalities similar to a CRM system designed for vishing teams. The platform is thought to be significantly AI-driven, enabling rapid deployment and ongoing support by a single operator. It features three role access for team management, callers, and administrators, offering an exhaustive overview of phishing activities.
Key Features and Capabilities
Work Panel includes numerous advanced characteristics, such as specialized workflows, audit logging, and a “self-destruct” capability to swiftly conclude operations. It utilizes Cloudflare for DNS management, NiceNIC for domain acquisitions, and a Caddy web server functioning as a reverse proxy, while Bunny CDN handles email click tracking. Integration with RocketReach provides access to contact information, including names, phone numbers, and LinkedIn profiles of targeted companies.
Instantaneous Target Surveillance
A notable aspect of Work Panel is its ability to monitor targets in real-time. As targets enter passwords or approve MFA requests on phishing sites, the information is directed to a manager’s session queue. Administrators can monitor and assist targets through phishing transactions, capturing sensitive data such as usernames, passwords, and MFA tokens. This data is then quickly sent to managers via a Telegram bot.
Impact on the Industry and Reactions
Although Okta has not revealed how Work Panel was acquired, it has notified legitimate feature misuse to Cloudflare and other service providers. Vishing, employed by groups like Scattered Spider and Scattered Lapsus$ Hunters, has shown to be extremely effective, leading to substantial breaches, including a 2025 incident involving Qantas that exposed over five million customer records.
Conclusion
Okta’s Work Panel signifies a crucial advancement in the tools designed for executing voice-phishing operations, automating various manual tasks while providing real-time monitoring features. While its introduction raises security alarms, initiatives are being implemented to address its potential misuse.



















