Spear Phishing Attack Targets Customers of Retool Development Platform

Description

According to Retool (a development platform) the compromise (through spear phishing and voice deepfaking) of an employee’s Google account (used for MFA cloud synchronization) allowed an attacker to control a number of customer accounts.

Impact

Reports indicate that a developer portal (built using Retool) was then compromised by the attacker to control end customer funds.

Type of Compromise

This compromise of Dev Tooling, possibly via Source Code changes impersonating an employee (rooted on the spear-phishing and voice deepfaking), exhibits various Chaining characteristics.

Additional references