Loading story…
Scattered LAPSUS$ Hunters (SLH/SLSH) has been observed recruiting women to conduct voice-phishing (vishing) calls aimed at corporate IT help desks, offering $500–$1,000 per call and providing pre-written scripts to guide impersonation attempts. Reporting based on Dataminr-collected Telegram posts indicates applicants are directed to contact a group “Support” account, undergo screening questions, and—if accepted—receive scripts intended to improve success rates in persuading help desk staff to reset passwords or otherwise facilitate account takeover.
The recruitment effort aligns with SLH’s established social-engineering tradecraft associated with the broader ecosystem of Lapsus$, Scattered Spider, and ShinyHunters, including tactics to bypass MFA such as SIM swapping and MFA prompt bombing (fatigue), and persuading targets to install or use remote monitoring and management (RMM) tooling for access. Dataminr assessed the focus on “female voices” is likely intended to evade common help-desk suspicion patterns and increase impersonation effectiveness; follow-on activity attributed to Scattered Spider-style intrusions has been linked in prior reporting to lateral movement, data theft, and in some cases ransomware deployment after initial access is obtained.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-24, Dataminr published an intelligence brief describing SLH's recruitment drive and assessed it as an evolution of the group's help-desk-focused social-engineering tactics. The report highlighted the use of prewritten scripts and recommended stronger identity verification and phishing-resistant MFA defenses.
On 2026-02-22, Scattered Lapsus$ Hunters posted recruitment messages on Telegram seeking women to conduct voice-phishing calls against IT help desks. The ads offered roughly $500 to $1,000 upfront per call and included prepared scripts to support impersonation attempts.
In October 2025, Scattered Lapsus$ Hunters was reported to have crowdsourced harassment of executives at extortion targets via Telegram, offering $10 in Bitcoin per action. The group later claimed, without independent verification, that it had paid out more than $1,000 shortly after the effort began.
In September 2025, Palo Alto Networks Unit 42 observed a case in which actors linked to Scattered Spider obtained privileged credentials through a help desk, conducted reconnaissance in virtualized environments, and attempted to exfiltrate Outlook mailbox files and Snowflake data. The case illustrated the group's established pattern of using social engineering for initial access followed by lateral movement and privilege escalation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcego.theregister.com
Open sourcethehackernews.com
Open sourcedataminr.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors associated with the Scattered Lapsus$ Hunters group have launched a sophisticated campaign targeting Zendesk users by creating over 40 typosquatted and impersonation domains designed to mimic legitimate Zendesk portals. These domains are used to harvest credentials through fake single sign-on pages and to submit malicious tickets to real Zendesk helpdesks, potentially delivering remote-access trojans (RATs) to support agents. The attackers' tactics mirror previous campaigns against Salesforce and are believed to be linked to the same criminal crew, with the potential for lateral movement within compromised organizations and theft of sensitive data. The campaign has also been connected to the September 2025 Discord breach, where attackers exploited Discord's Zendesk-based support system to steal user data, including government-issued IDs and billing information. Separately, investigative reporting has identified a 15-year-old in Jordan, known online as "Rey," as a possible key figure in the Scattered Lapsus$ Hunters group. The group, which combines elements of Scattered Spider, Lapsus$, and ShinyHunters, has been implicated in high-profile data thefts from companies such as Salesforce, Toyota, and FedEx. The identification of "Rey" was based on digital footprints and personal information inadvertently revealed in cybercrime forums and Telegram channels. The group has also attempted to recruit insiders at targeted companies, further increasing the threat posed by their operations.
Jun 29, 2026
Threat intelligence reporting warned that victims of **Scattered Lapsus$ Hunters**—a **The Com**-linked extortion operation also using names such as **ShinyHunters** and **SLSH**—should **not negotiate or pay**, citing a pattern of escalating coercion and unreliable promises to delete or return stolen data. The campaign is characterized as **data-theft extortion without encryption**, where attackers threaten public leaks while simultaneously applying pressure through media manipulation and aggressive outreach designed to overwhelm incident response and executive decision-making. Unit 221B described harassment tactics used to intensify negotiations and reputational damage, including **DDoS**, **email/SMS flooding**, and **swatting**, alongside threats that can extend to **physical intimidation of executives and families**. Reporting also noted the group’s tendency to contact journalists to amplify pressure and create negative PR during active incidents, and assessed the operation as volatile and internally conflicted—behavior that can increase risk to victims while limiting the group’s operational discipline. The recommended focus for impacted organizations is **containment, remediation, and stakeholder notification**, recognizing that once data is stolen, payment does not “un-breach” it.
Jun 29, 2026
The Scattered Lapsus$ Hunters threat group has re-emerged after a period of inactivity, unveiling a new Ransomware-as-a-Service (RaaS) platform called ShinySp1d3r. This platform is reportedly a collaboration involving operators from ShinyHunters, Scattered Spider, and Lapsus$, and marks a shift in the group’s tactics toward structured insider recruitment and commission-based access deals. The group is actively seeking insiders from large organizations, particularly those with annual revenues over $500 million, and is excluding targets in Russia, China, North Korea, Belarus, and the healthcare sector. Recruitment efforts are focused on individuals who can provide privileged access to corporate systems, with tiered commissions for different types of access, and the group is leveraging underground forums and Telegram channels to coordinate these activities. Simultaneously, security researchers have been monitoring and countering the group’s activities. Resecurity deployed a honeypot that successfully engaged members of the Scattered Lapsus$ Hunters, leading to the exposure of internal communications and operational details. These communications revealed ongoing harassment campaigns against U.S. government officials and connections to high-profile breaches, such as the Snowflake incident, which impacted at least 160 organizations. The group’s renewed operations and aggressive insider recruitment strategy represent a significant escalation in their threat profile, with implications for a wide range of industries and government entities.
Jun 29, 2026