ShinyHunters SaaS Data Theft via Vishing-Enabled SSO Credential and MFA Capture

Timeline

1. May 1, 2026

   Canadian Centre for Cyber Security issues SaaS social-engineering alert

   The Canadian Centre for Cyber Security issued Alert AL26-010 warning of ongoing financially motivated attacks against enterprise identity services and SaaS platforms using vishing, brand impersonation, adversary-in-the-middle phishing, help-desk abuse, and theft of OAuth refresh tokens from compromised third-party vendors. The alert said attackers typically pivot through SaaS environments via compromised SSO identities, exfiltrate data through legitimate APIs and export features, and pursue extortion without usually deploying malware, while recommending phishing-resistant MFA and tighter identity and SaaS controls.

2. May 1, 2026

   CrowdStrike reports Cordial Spider and Snarky Spider SaaS extortion activity

   CrowdStrike warned that the cybercrime clusters Cordial Spider and Snarky Spider were using vishing and adversary-in-the-middle SSO phishing to compromise identity providers and connected SaaS apps, then steal data for extortion. The report added that the actors remove existing MFA devices, create inbox rules to suppress security alerts, and in Snarky Spider cases can begin exfiltration in under an hour.

3. Mar 11, 2026

   Obsidian details Okta persistence and SaaS pivot patterns in ShinyHunters campaign

   Obsidian Security published new technical findings from three 2026 incidents showing attackers used anomalous, failure-heavy Okta login flows, then enrolled Okta FastPass or Okta Verify on devices named "Passkey," often linked to Genymobile-associated Android emulators. The report said the intruders quickly enumerated SSO-connected apps, pivoted into services such as Slack, Google Drive, Salesforce, and VPNs, and conducted bulk file downloads consistent with automated data exfiltration.

4. Feb 26, 2026

   ReliaQuest reports shift to branded subdomain impersonation in ShinyHunters campaign

   ReliaQuest reported that ShinyHunters had evolved its SaaS intrusion playbook to use branded subdomain impersonation and mobile-first, phone-guided adversary-in-the-middle phishing, often themed around SSO and Okta. The firm also assessed that the group was reusing previously exposed enterprise data to improve social-engineering pretexts and scaling operations through outsourced vishing and spam services, including Telegram-recruited voice operators.

5. Jan 31, 2026

   Mandiant publishes report on ShinyHunters-linked SSO and MFA bypass tactics

   Mandiant publicly detailed how ShinyHunters-linked clusters use synchronized vishing and phishing kits to capture credentials and MFA codes, enroll attacker-controlled MFA devices, and steal data from SaaS platforms. The report also provided indicators, infrastructure patterns, and defensive guidance for detecting and stopping the intrusions.

6. Jan 30, 2026

   Match Group responds to ShinyHunters claims affecting dating apps

   ShinyHunters also claimed theft of more than 10 million records from Hinge, Match, and OkCupid. Match Group characterized the incident as limited in scope and said there was no indication that login credentials, financial data, or private communications were accessed.

7. Jan 30, 2026

   ShinyHunters claims theft of 30 GB of Bumble data

   Reports said ShinyHunters claimed to have stolen about 30 GB of Bumble data, largely internal files allegedly taken from Google Drive and Slack. The claim was part of a broader string of alleged SaaS-focused thefts attributed to the group.

8. Jan 30, 2026

   Bumble discloses contractor-account compromise via phishing

   Bumble acknowledged a recent breach involving a contractor account compromised through phishing. The company said no user chats or profiles were exposed and that its investigation was ongoing.

9. Jan 26, 2026

   Silent Push reports ShinyHunters targeting about 100 organizations

   Silent Push said ShinyHunters was running an active voice-phishing campaign to steal Okta SSO credentials from roughly 100 organizations, including Canva, with evidence of targeting or infrastructure preparation across multiple industries. Mandiant confirmed the activity and said the attackers used vishing to capture credentials, enroll attacker-controlled MFA devices, access SaaS platforms, steal data, and sometimes extort victims.

10. Jan 15, 2026

    Mandiant observes intensified intrusions and data theft in mid-January

    In early to mid-January, Mandiant observed the clusters expanding activity across Okta, Microsoft 365, Google Workspace, SharePoint, OneDrive, Slack, Salesforce, and DocuSign. Attackers enrolled their own MFA devices, moved laterally through SaaS environments, and exfiltrated bulk cloud data for extortion.

11. Jan 1, 2026

    ShinyHunters-linked vishing campaign begins targeting SaaS environments

    Mandiant said the social-engineering campaign tied to clusters UNC6661, UNC6671, and UNC6240 was active by early January 2026. Attackers impersonated IT or help-desk staff, used company-branded phishing pages to capture SSO credentials and MFA codes, and then accessed cloud applications.