Work Panel: Inside the SaaS-Style Console Powering Okta-Targeting Vishing Attacks

Okta’s threat intelligence team has pulled back the curtain on one of the more unsettling developments in identity-based cybercrime: a fully operational, multi-tenant “operator console” called Work Panel that turns voice phishing into a managed service business.

The platform, tied to an intrusion cluster Okta tracks as O-UNC-045 (aka CORDIAL SPIDER), isn’t a phishing kit in the traditional sense. It’s closer to a CRM built for running account-takeover campaigns against Okta, Microsoft 365, and Salesforce customers at scale.

The find matters because it reframes how defenders should think about vishing. This isn’t a lone attacker with a cloned login page. It’s organized crime with role-based access control, audit logs, and a kill switch.

Work Panel splits its workforce into three server-enforced roles: caller, manager, and admin. Each sees a different slice of the platform, and the access boundary is enforced on the backend, not just hidden in the UI.

Callers get a target lookup tool and SIP credentials, nothing more.
Managers control a live session queue and can push targets through fake MFA challenge screens in real time.
Admins own the infrastructure pipeline: domain buying, DNS, CDN, and a self-destruct button.

The critical design choice is what callers can’t see: the stolen credentials. When a target submits a password or approves an MFA push, the data is routed straight to the manager’s screen. The caller, still on the phone coaching the victim through each step, never touches the payoff.

The admin console does the heavy lifting that used to take a technical operator hours. Buying a domain through NiceNIC, spinning up a Cloudflare DNS zone, provisioning a Caddy reverse proxy, and deploying a PM2-managed process for a new phishing site are each single-button actions.

Pasting a target company’s Okta sign-in URL auto-pulls their logo, color scheme, and tenant domain for instant brand cloning. A new, fully branded phishing site can go live within minutes of registering the domain.

Bunny CDN handles redirect links for a parallel email-phishing channel, complete with a template editor using {{variable}} placeholders that auto-populate with the cloned brand’s details.

The most striking element isn’t the tooling; it’s the labor model. Callers are recruited from public Telegram channels, paid per successful capture, and treated as disposable. Because they never see the credentials they help steal, a disgruntled or opportunistic caller has nothing to sell to a rival crew.

Admins can even secretly watch a caller’s live screen through a “Live View” feature, with only password fields masked, and the caller is never told they’re being observed.

This isn’t incidental. It’s a deliberate insider-threat mitigation strategy borrowed straight from enterprise SaaS security practices, repurposed to control criminal gig workers rather than employees.

Okta’s analysts assess that Work Panel was likely “vibe-coded”, built substantially with AI coding assistants, based on its polished, templated UI patterns.

That lowers the barrier for a single developer to ship and maintain a platform sophisticated enough to sell to multiple independent criminal tenants simultaneously, each bringing their own registrar accounts, SIP providers, and callers.

The defensive playbook against vishing hasn’t fundamentally changed: phishing-resistant MFA, number-matching skepticism, and helpdesk verification protocols still work. What’s changed is velocity.

Campaigns that once took days to stand up now launch in minutes, and infrastructure seized by defenders can be rebuilt within hours via the platform’s automation.

For security teams, the takeaway is less about any single IOC and more about the maturity curve: vishing operations are industrializing, and detection strategies built for one-off phishing kits won’t keep pace with software-as-a-service crime.