Loading story…
ShinyHunters has broadened its operations from data theft into a wider cloud-focused extortion campaign targeting enterprise SaaS and identity platforms, with reported intrusions involving Okta, Salesforce, cloud management systems, and CI/CD environments. Public reporting links the group to phishing, vishing, brute-force activity, exploitation of internet-facing applications including CVE-2021-35587 and the Oracle PeopleSoft zero-day CVE-2026-35273, abuse of OAuth tokens, and theft of assets such as BrowserStack API keys that could enable supply-chain compromise. Researchers also reported insider recruitment efforts aimed at personnel with access to Okta, Microsoft SSO, Citrix VPN, GitHub, and GitLab, while the group allegedly uses leak sites and services such as LimeWire to pressure victims into seven-figure payments or sell stolen datasets.
The FBI separately warned that ShinyHunters claimed responsibility for a disruptive attack on an online Learning Management System used by educational institutions and students across the United States, underscoring the group’s reach beyond traditional enterprise victims. According to the alert, the actors specialize in large-scale breaches and extortion and may follow intrusions with extortion emails, threatening texts, phone calls, impersonation, spearphishing, and even swatting, sometimes falsely claiming to hold compromising material. MITRE and industry reporting also associate ShinyHunters with aliases including UNC6240 and Bling Libra, ties to The Com and overlaps with Scattered Spider, and note signs the group may be moving toward ransomware through a reported shinysp1d3r platform with ESXi encryption capability.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
MITRE ATT&CK published an entry for ShinyHunters as group G1057, associating it with aliases including UNC6240 and Bling Libra and documenting tactics including exploitation of Oracle PeopleSoft zero-day CVE-2026-35273.
The FBI issued a Public Service Announcement warning about a ShinyHunters-claimed cyberattack that disrupted an online learning management system used by educational institutions and students across the United States.
EclecticIQ assessed that ShinyHunters has operated Okta-themed phishing infrastructure since early 2025, targeting sectors including investment banking, luxury retail, travel, payment processing, and e-commerce.
EclecticIQ observed ShinyHunters cloning the login flow of a legitimate Okta subdomain and reusing the phishing template across campaigns from June 29, 2023 through June 10, 2025.
EclecticIQ reports that ShinyHunters emerged in 2020 as a financially motivated threat group led by the ShinyCorp persona.
MITRE ATT&CK states ShinyHunters has been active since at least 2019 under the ShinyCorp persona, operating as a cybercriminal collective focused on credential and PII theft for resale and extortion.
EclecticIQ reported that ShinyHunters had expanded beyond data theft into cloud-focused intrusions using AI-enabled vishing, supply-chain access, and insider recruitment, with targeting of SSO and engineering platforms.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
attack.mitre.org
Open sourceic3.gov
Open sourceblog.eclecticiq.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google-owned **Mandiant** reported an expansion in **ShinyHunters**-style intrusions using **voice phishing (vishing)** and spoofed credential-harvesting sites to steal **SSO credentials** and **MFA codes**, enabling unauthorized access to cloud **SaaS** environments. Mandiant tracked the activity across multiple clusters (**UNC6661**, **UNC6671**, and **UNC6240** / *ShinyHunters*) and assessed the objective as data theft from cloud applications (including internal communications) followed by **extortion**, with some incidents involving escalatory pressure such as **harassment of victim personnel**. In observed tradecraft, operators impersonated IT staff, directed employees to phishing links under the pretext of updating MFA settings, then used captured credentials to enroll attacker-controlled devices for MFA. Separate reporting characterized the same campaign as a broad vishing operation with **hundreds of organizations** in scope, reinforcing that the activity is not limited to a single SaaS provider and is focused on identity-layer compromise rather than software exploitation. Other items in the set were unrelated: a supply-chain compromise of *eScan* antivirus update infrastructure distributing a backdoor, a Fortinet write-up on **Interlock** ransomware tradecraft, an article on EU vulnerability identifier policy, and general security-awareness/detection-engineering content; these do not describe the ShinyHunters vishing activity and should not be treated as part of the same incident thread.
Jun 29, 2026
**ShinyHunters** has been linked to a wave of SaaS-focused data-theft and extortion activity enabled by targeted **voice phishing (vishing)** and company-branded phishing portals designed to capture **SSO credentials** and **MFA codes**. Mandiant reported that attackers impersonate IT/helpdesk staff, direct employees to realistic login pages, and use real-time interaction (including guiding victims to approve push prompts or provide one-time codes) to authenticate and then **enroll attacker-controlled devices into MFA**. After account takeover, the actor pivots through **Okta, Microsoft Entra, or Google** SSO dashboards to rapidly access downstream SaaS services (e.g., *Salesforce*, *Microsoft 365/SharePoint*, *DocuSign*, *Slack*, *Atlassian*, *Dropbox*, *Google Drive*), turning a single compromised identity into broad cloud data access. Separately, **Bumble** reported a phishing-driven compromise of a **contractor account**, after which ShinyHunters allegedly claimed theft of ~**30 GB** of data—reported as largely internal files sourced from **Google Drive** and **Slack**—while Bumble stated there was no evidence of exposure of user chats or profiles. Reporting also tied ShinyHunters to other claimed or alleged thefts affecting consumer and enterprise brands (including Match Group properties such as *Hinge*, *Match*, and *OkCupid*), consistent with the broader pattern of leveraging compromised identities and SaaS access paths for data exfiltration and extortion leverage.
Jun 29, 2026
Health-ISAC warned that **ShinyHunters** is increasingly targeting healthcare and medical technology organizations through identity-focused social engineering, especially voice phishing, to seize control of single sign-on environments and connected SaaS platforms. Reported attack chains involve manipulating helpdesk staff or employees into resetting passwords, changing MFA methods, or enrolling attacker-controlled devices, followed by compromise of **Microsoft Entra**, **Okta**, or **Google SSO** accounts and rapid access to services such as **Microsoft 365**, **SharePoint**, and **Salesforce** for large-scale data exfiltration. The group is being tracked more as an **extortion-by-data-theft** actor than a traditional ransomware operator, with recent incident reporting citing theft from enterprise cloud environments after SSO compromise. Separate reporting also identified **RingCentral** as a claimed victim, with attackers alleging stolen data and threatening to leak it unless contacted, underscoring the group’s broader pattern of using compromised identity infrastructure and SaaS access to pressure victims. Health-ISAC urged organizations to treat SSO as a critical control plane, harden helpdesk and MFA reset workflows, deploy phishing-resistant MFA and conditional access, centralize identity and SaaS logging, and prepare cloud-focused containment playbooks.
Aug 4, 2026