Loading story…
Threat actors associated with the Scattered Lapsus$ Hunters group have launched a sophisticated campaign targeting Zendesk users by creating over 40 typosquatted and impersonation domains designed to mimic legitimate Zendesk portals. These domains are used to harvest credentials through fake single sign-on pages and to submit malicious tickets to real Zendesk helpdesks, potentially delivering remote-access trojans (RATs) to support agents. The attackers' tactics mirror previous campaigns against Salesforce and are believed to be linked to the same criminal crew, with the potential for lateral movement within compromised organizations and theft of sensitive data. The campaign has also been connected to the September 2025 Discord breach, where attackers exploited Discord's Zendesk-based support system to steal user data, including government-issued IDs and billing information.
Separately, investigative reporting has identified a 15-year-old in Jordan, known online as "Rey," as a possible key figure in the Scattered Lapsus$ Hunters group. The group, which combines elements of Scattered Spider, Lapsus$, and ShinyHunters, has been implicated in high-profile data thefts from companies such as Salesforce, Toyota, and FedEx. The identification of "Rey" was based on digital footprints and personal information inadvertently revealed in cybercrime forums and Telegram channels. The group has also attempted to recruit insiders at targeted companies, further increasing the threat posed by their operations.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Public statements attributed to Scattered Lapsus$ Hunters threatened additional campaigns and data leaks, including claims of stolen Salesforce customer records. Reporting also said the group promised to return in 2026 with an 'extortion-as-a-service' model despite earlier shutdown claims.
After identifying the fake Zendesk domains and associated attack workflow, ReliaQuest shared its findings with Zendesk. At the time of reporting, Zendesk had not publicly commented.
An investigative report published on November 27, 2025 identified a 15-year-old Jordanian known as 'Rey' as an alleged key member of Scattered Lapsus$ Hunters. The accused individual and the group publicly denied the claims, and no law enforcement action was reported.
ReliaQuest discovered more than 40 typosquatted and impersonation domains mimicking Zendesk portals, used to harvest credentials and submit malicious support tickets. The infrastructure was linked to Scattered Lapsus$ Hunters and mirrored patterns seen in earlier Salesforce-related activity.
Scattered Lapsus$ Hunters was also linked to the Gainsight compromise reported in November 2025. The attribution reinforced the view that the group was expanding its focus to SaaS and customer-support ecosystems.
The coalition was later assessed to be responsible for the Discord breach reported in September 2025. This incident became one of the early major attacks attributed to the group.
Scattered Lapsus$ Hunters emerged in August 2025 as a coalition blending members and tactics associated with Scattered Spider, Lapsus$, and ShinyHunters. Researchers described it as a new grouping focused on social engineering, SaaS platforms, and extortion.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcego.theregister.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new cybercrime supergroup known as Scattered LAPSUS$ Hunters has emerged in 2025, combining the capabilities and tactics of three notorious threat actors: Scattered Spider, LAPSUS$, and ShinyHunters. This alliance marks a significant escalation in the threat landscape, as the group leverages a blend of social engineering, technical attacks, and public extortion to target high-value enterprise environments. The group is known for its multi-phase assaults, which often begin with sophisticated social engineering techniques such as phone-based vishing to gain initial access, particularly by targeting help desks and exploiting human vulnerabilities. Once inside, the attackers employ insider recruitment, source code theft, and large-scale data exfiltration, drawing on the distinct strengths of each constituent group. Scattered LAPSUS$ Hunters have focused their attacks on major SaaS platforms, including Salesforce, as well as enterprise applications from Oracle and SAP. Their victim list includes prominent organizations across retail, aviation, insurance, and automotive sectors, with named targets such as Home Depot, Marriott, the National Bank of Canada, and Tata Motors' Jaguar Land Rover. The group’s operations are characterized by unpredictability and a willingness to disrupt major businesses, often causing significant operational and reputational damage. Unlike traditional ransomware groups, Scattered LAPSUS$ Hunters do not limit themselves to endpoint infections and ransom demands; they also engage in ransoming stolen data and public extortion campaigns. The group’s members, reportedly including Western teenagers with substantial cryptocurrency holdings, operate with little regard for the consequences of their actions, further complicating law enforcement efforts. Their tactics reflect a shift from the previously dominant Russian ransomware model to a more chaotic, opportunistic approach. The group’s emergence from the cybercrime community known as The Com highlights the evolving nature of cybercriminal alliances and the increasing sophistication of their playbooks. Security experts have noted that the group’s attacks are not only technically advanced but also highly adaptive, making them particularly challenging to defend against. Organizations are advised to strengthen their social engineering defenses, monitor for insider threats, and enhance detection capabilities for unusual access patterns. The rise of Scattered LAPSUS$ Hunters underscores the need for a holistic security posture that addresses both technical and human vulnerabilities. Their activities in 2025 have set a new benchmark for the scale and impact of cybercrime supergroups, prompting urgent calls for improved cross-sector collaboration and intelligence sharing.
Jun 29, 2026
Recent threat activity has highlighted two distinct user-targeted campaigns: mass spam sent from legitimate **Zendesk** domains and a browser-crash social-engineering chain delivering malware. Multiple users reported receiving hundreds of emails originating from real companies’ Zendesk helpdesk instances (including brands such as Live Nation, Capcom, and Tinder), with many messages bypassing common spam filters; the lures included bogus legal notices intended to drive credential theft, initial access, or payment. Zendesk has previously warned about attackers abusing its platform for **relay spam**, and reporting indicated the current wave was not tied to a Zendesk breach or a specific software vulnerability. Separately, Huntress reported a more sophisticated **ClickFix**-style operation dubbed **“CrashFix”** that uses a malicious Chrome Web Store extension (*NexShield*, masquerading as *uBlock Origin Lite*) to intentionally crash the victim’s browser and then present a fake “fix” prompt that advances the infection chain. The campaign was attributed to **KongTuke** and culminates in delivery of a Python-based RAT (**ModeloRAT**), with **domain-joined systems** receiving specially tailored backdoor payloads—raising risk for enterprise environments where browser-based workflows are prevalent. Other items in the set were general-interest content (enterprise browser product comparison, a cyberattacks timeline roundup, and an acquisition announcement) and did not provide additional, specific reporting on these two active campaigns.
Jun 29, 2026
**Scattered LAPSUS$ Hunters (SLH/SLSH)** has been observed recruiting **women** to conduct **voice-phishing (vishing)** calls aimed at **corporate IT help desks**, offering **$500–$1,000 per call** and providing **pre-written scripts** to guide impersonation attempts. Reporting based on **Dataminr**-collected Telegram posts indicates applicants are directed to contact a group “Support” account, undergo screening questions, and—if accepted—receive scripts intended to improve success rates in persuading help desk staff to reset passwords or otherwise facilitate account takeover. The recruitment effort aligns with SLH’s established social-engineering tradecraft associated with the broader ecosystem of **Lapsus$**, **Scattered Spider**, and **ShinyHunters**, including tactics to bypass MFA such as **SIM swapping** and **MFA prompt bombing (fatigue)**, and persuading targets to install or use **remote monitoring and management (RMM)** tooling for access. Dataminr assessed the focus on “female voices” is likely intended to evade common help-desk suspicion patterns and increase impersonation effectiveness; follow-on activity attributed to Scattered Spider-style intrusions has been linked in prior reporting to lateral movement, data theft, and in some cases ransomware deployment after initial access is obtained.
Jun 29, 2026