And all of them operate via Telegram, a cloud-based instant messaging system. But according to research from cyber intelligence firm Intel 471, multiple new OTP interception services have emerged to fill that void. OTP Agency took itself offline within hours of that story. The call would prompt the target to enter an OTP token generated by their phone’s mobile app (“for authentication purposes”), and that code would then get relayed back to the bad guy customers’ panel at the OTP Agency website. The customer would enter a target’s phone number and name, and OTP Agency would initiate an automated phone call that alerts that person about unauthorized activity on their account. The OTP interception service featured earlier this year - Otpagency - advertised a web-based bot designed to trick targets into giving up OTP tokens.
without access to the victim’s mobile device or phone number.
The idea is that even if the user’s password gets stolen, the attacker still can’t access the user’s account without that second factor - i.e. Many websites now require users to supply both a password and a numeric code/OTP token sent via text message, or one generated by mobile apps like Authy and Google Authenticator. An ad for the OTP interception service/bot “SMSRanger.”