SecOps teams spend years refining role-based access control (RBAC) to enforce least privilege. Now the same principles are being weaponized against you.
Work Panel, a multi-tenant vishing platform used by threat actors targeting Okta and other identity providers, implements server-enforced RBAC that would look familiar to any IAM architect. The platform separates callers, managers, and admins into distinct workspaces with different permissions, visibility, and operational controls. The difference? This RBAC system exists to scale credential theft.
The Challenge
Traditional phishing kits ship as folders of HTML and PHP files. One operator deploys them, watches them, and manages the operation alone. Work Panel represents a fundamental shift: it's a full web application designed to run vishing-driven account takeover as a business. The platform packages everything an operator needs to launch campaigns in minutes, from domain registration to brand cloning to live session management.
The technical challenge for defenders isn't just detecting phishing sites anymore. It's detecting an industrialized operation where:
- Infrastructure provisioning happens through API integration with NiceNIC, Cloudflare, and Bunny CDN
- Each phishing site runs on its own subdomain with its own PM2 process and Caddy reverse-proxy block
- Operators can tear down every phishing site, process, and DNS record with a single self-destruct endpoint
- The workforce is distributed across roles that can't see each other's work
The Environment and Constraints
Work Panel's architecture reveals how threat actors think about operational security. The platform enforces access boundaries server-side, not just in the UI. A caller can't view captured credentials. A manager can only see callers they personally onboarded. The admin holds the infrastructure keys and the kill switch.
This design solves two problems for operators. First, it protects against insider risk. Callers are treated as interchangeable labor who never see the credentials they help capture. Second, it enables scale. Multiple intrusion clusters can run parallel deployments, each bringing their own integrations and workforce.
The platform integrates RocketReach, a commercial B2B contact-data service, directly into the caller workspace. This isn't stolen data. It's purchased through legitimate channels, then weaponized. By the time the phone rings, the caller knows the target's job title, direct phone number, and often their manager's name.
The Approach Taken
The three-role structure mirrors legitimate IAM practices, but inverted:
Caller role: Restricted to target lookup, SIP credentials for external softphones, and a limited mailer. No visibility into live sessions, captured credentials, or other callers' work. The caller's job is reconnaissance and social engineering. When a target submits credentials, those values flow to the manager's workspace, not the caller's screen.
Manager role: Supervises callers and operates the live target queue. Each row shows a browser session status (live, idle, or stalled based on ping frequency), country flag, identifier, and current page. The manager pushes authentication challenge pages to the target's browser in real time while the caller talks them through each step. Captured usernames, passwords, and MFA codes appear in a session detail panel with copy buttons. Every copy action is logged.
Admin role: Owns the infrastructure pipeline. Types a domain name into a form, and the platform checks availability against NiceNIC, registers it, spins up a Cloudflare DNS zone, configures a Caddy reverse-proxy block, and creates a PM2 process. New phishing sites are live within minutes. The admin also rotates API keys, manages the self-destruct endpoint, and configures Telegram notification channels.
When targeting Okta, pasting any sign-in URL automatically retrieves the organization's logo, favicon, primary color, company name, and tenant domain. For Microsoft targets, pasting a corporate email address pulls tenant branding via Microsoft's own tenant-discovery endpoints.
Results and What Works
The platform's effectiveness comes from automation and compartmentalization. Each phishing site runs independently with its own subdomain, process, and configuration. Operators can launch new campaigns without touching existing infrastructure. The fixed menu of authentication challenge pages means managers can't accidentally break the flow by pushing arbitrary URLs.
The integration with RocketReach transforms cold calling into targeted social engineering. The data isn't technically stolen, which makes it harder to detect at the source. The SIP credential handoff to external softphones keeps the calling infrastructure separate from the phishing infrastructure.
The server-side role enforcement prevents callers from exfiltrating credentials independently. This gives operators exclusive access to campaign spoils and significant control over hired callers.
Takeaways for Your Team
Rethink your detection posture. You're not just looking for phishing sites anymore. You're looking for coordinated operations with distributed infrastructure, legitimate data sources, and real-time session manipulation. Monitor for rapid DNS changes, multiple subdomains appearing under newly registered domains, and authentication patterns that show someone advancing a user through an MFA flow page by page.
Instrument your authentication flows. If your identity provider supports it, log every page transition during sign-in. Unusual sequences (like a user landing on a number-matching page when your tenant doesn't use number matching) indicate session manipulation. Track timing between authentication steps. A user who pauses for 30 seconds between password entry and MFA approval might be waiting for a manager to push the next page.
Treat B2B contact data as an attack vector. Services like RocketReach aren't security threats by themselves, but they're weaponized inside platforms like Work Panel. Your employees' job titles, direct phone numbers, and reporting structures are available for purchase. Build your security awareness training around that reality. Users should expect attackers to know their manager's name.
Test phishing-resistant authentication seriously. FIDO2 security keys break the vishing model. A caller can't talk a user through tapping "Approve" on a push notification if there's no push notification to approve. The authentication ceremony requires cryptographic proof of the domain, which a phishing site can't fake even with the user's cooperation.
Audit your own role boundaries. Work Panel's RBAC model should make you uncomfortable because it probably mirrors your own access control structure. Are your role boundaries enforced server-side or just hidden in the UI? Can your help desk see more than they need to? Would an insider with caller-level access be able to escalate?
The persistent components of this threat aren't the phishing sites. They're the platform, the infrastructure pipelines, and the recruitment networks. Your defenses need to match that persistence.
