# Retool breach: SMS phishing, deepfaked voice call and synced MFA codes · pwn.watch

> An attacker phished a Retool employee by SMS, then called them with a deepfaked voice to get an MFA code. Because Google Authenticator synced codes to the employee's Google account, the attacker got their MFA codes too, and took over 27 cloud customer accounts, all in crypto.

Page: https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023 · generated 2026-10-23T03:54:42.456Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Retool (cloud)
- Started: 2023-08-27 · closed: 2023-09-13

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023/feed.xml
- JSON Feed: https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023.json
- This file: https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023/llms.txt

## Updates (newest first)
- 2023-09-13: Retool publishes its write-up (https://retool.com/blog/mfa-isnt-mfa)
- 2023-08-27: SMS phishing and voice call lead to compromise of a Retool employee account and 27 cloud customers (https://retool.com/blog/mfa-isnt-mfa)

## Fix brief
# Security brief: Retool breach: SMS phishing, deepfaked voice call and synced MFA codes

Source: https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023 · status: closed (closed Sep 13, 2023) · severity: high · updated Sep 13, 2023

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
An attacker phished a Retool employee by SMS, then called them with a deepfaked voice to get an MFA code. Because Google Authenticator synced codes to the employee's Google account, the attacker got their MFA codes too, and took over 27 cloud customer accounts, all in crypto.

Severity detail: Social engineering; account takeover of cloud customers

- Product: Retool (cloud)

## Affected versions
- Not specified in the data. Check the advisories below.

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Latest updates
- Sep 13, 2023: Retool publishes its write-up
- Aug 27, 2023: SMS phishing and voice call lead to compromise of a Retool employee account and 27 cloud customers

## Advisories
- [When MFA isn't actually MFA](https://retool.com/blog/mfa-isnt-mfa) (Retool)

---
Machine-readable: https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.