Technology Cybersecurity Solutions & Training

In September 2022, an attacker reached Uber's internal systems through the account of an external contractor. Uber said the attacker had most likely bought the contractor's corporate password on the dark web after malware infected the contractor's personal device.

The account was protected by multi-factor authentication, so the attacker sent sign-in approval requests to the contractor's phone again and again. According to accounts of the breach, the attacker then messaged the contractor on WhatsApp, posing as Uber IT, and said the requests would stop once one was approved. The contractor approved one, and the attacker moved into internal tools from there. Uber linked the attack to the Lapsus$ group.

From the contractor's side, it looked like a technical glitch, not an attack. Sign-in prompts kept appearing for a login they had not attempted, which is confusing, and confusion is exactly the state in which people reach for the simplest explanation offered to them. When a message arrived from someone presenting as the company's IT team, it supplied that explanation and a way to make the problem stop.

Contractors are especially exposed in moments like this. They sit outside the organization's structure, often know fewer people inside it, and have a weaker sense of what a genuine message from IT looks like, so a plausible one is harder to question. Approving a prompt also costs nothing visible: no money moves, no file opens, the screen simply goes quiet. The consequences were real, but they happened somewhere the contractor could not see.

An unexpected approval request is an attack signal, and people learn to treat it that way through practice. Whitebait runs MFA-targeted simulations alongside credential harvesting and QR lures, and shows which users act on them.

Contractors with access to internal tools belong in the same risk model as employees. Odin weighs role, privileges, and user criticality, so an outside engineer with production access ranks above an employee without it, and crossing a critical threshold triggers an automatic escalation.

The WhatsApp message relied on authority and relief: IT is asking, and approving makes the noise stop. Codex training covers exactly those psychological levers, and Zero-Touch Training assigns it the moment a user's behavior shows the gap. Through the Teams App, reporting a strange prompt to security takes one tap.