{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T21:29:54.052Z",
  "tag": {
    "id": "google-authenticator",
    "label": "Google Authenticator",
    "isStack": false,
    "url": "https://pwn.watch/t/google-authenticator",
    "feed": "https://pwn.watch/t/google-authenticator/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "retool-sms-phishing-google-authenticator-sync-2023",
      "title": "Retool breach: SMS phishing, deepfaked voice call and synced MFA codes",
      "url": "https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023",
      "json": "https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Retool (cloud)",
      "tags": [
        "retool",
        "phishing",
        "social-engineering",
        "google-authenticator",
        "crypto"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-08-27",
      "closedAt": "2023-09-13",
      "updatedAt": "2023-09-13",
      "summary": "An attacker phished a Retool employee by SMS, then called them with a deepfaked voice to get an MFA code. Because Google Authenticator synced codes to the employee's Google account, the attacker got their MFA codes too, and took over 27 cloud customer accounts, all in crypto.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "retool-sms-phishing-google-authenticator-sync-2023",
      "incidentTitle": "Retool breach: SMS phishing, deepfaked voice call and synced MFA codes",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-09-13",
      "title": "Retool publishes its write-up",
      "body": null,
      "sourceUrl": "https://retool.com/blog/mfa-isnt-mfa",
      "url": "https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023"
    },
    {
      "incident": "retool-sms-phishing-google-authenticator-sync-2023",
      "incidentTitle": "Retool breach: SMS phishing, deepfaked voice call and synced MFA codes",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-08-27",
      "title": "SMS phishing and voice call lead to compromise of a Retool employee account and 27 cloud customers",
      "body": null,
      "sourceUrl": "https://retool.com/blog/mfa-isnt-mfa",
      "url": "https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023"
    }
  ]
}