Loading story…
Health-ISAC warned that ShinyHunters is increasingly targeting healthcare and medical technology organizations through identity-focused social engineering, especially voice phishing, to seize control of single sign-on environments and connected SaaS platforms. Reported attack chains involve manipulating helpdesk staff or employees into resetting passwords, changing MFA methods, or enrolling attacker-controlled devices, followed by compromise of Microsoft Entra, Okta, or Google SSO accounts and rapid access to services such as Microsoft 365, SharePoint, and Salesforce for large-scale data exfiltration.
The group is being tracked more as an extortion-by-data-theft actor than a traditional ransomware operator, with recent incident reporting citing theft from enterprise cloud environments after SSO compromise. Separate reporting also identified RingCentral as a claimed victim, with attackers alleging stolen data and threatening to leak it unless contacted, underscoring the group’s broader pattern of using compromised identity infrastructure and SaaS access to pressure victims. Health-ISAC urged organizations to treat SSO as a critical control plane, harden helpdesk and MFA reset workflows, deploy phishing-resistant MFA and conditional access, centralize identity and SaaS logging, and prepare cloud-focused containment playbooks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
RingCentral was identified as the victim of a data breach attributed to ShinyHunters. The incident report said the breach occurred on July 27, 2026, and was discovered later the same day, with the attackers claiming to have compromised an unspecified amount of data.
Health-ISAC warned that healthcare and medical technology organizations were seeing an increase in successful ShinyHunters intrusions focused on identity and SaaS access for data theft and extortion. The advisory described vishing-led helpdesk and MFA-reset abuse leading to SSO compromise and exfiltration from platforms such as Microsoft 365 and SharePoint.
DentaQuest disclosed that a ShinyHunters-linked hack in May 2026 compromised sensitive information belonging to 15 million people. Health-ISAC cited the case as part of a broader healthcare-focused data-theft and extortion wave and noted victim notification totals can exceed attacker claims as forensic work continues.
Bridewell said it uncovered an active phishing infrastructure of more than 100 malicious domains after investigating a blocked vishing attempt, and assessed the campaign was linked to ShinyHunters and shared across multiple Com-affiliated threat actors. The infrastructure impersonated Okta and Microsoft Entra ID and was linked to organizations including Abbott, Ralph Lauren, and RingCentral that later appeared on the group's leak site.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
health-isac.org
Open sourcehealth-isac.org
Open sourcecyberveille.ch
Open sourcehipaajournal.com
Open sourceitsecurityguru.org
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcehookphish.com
Open sourcehealth-isac.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**ShinyHunters** has been linked to a wave of SaaS-focused data-theft and extortion activity enabled by targeted **voice phishing (vishing)** and company-branded phishing portals designed to capture **SSO credentials** and **MFA codes**. Mandiant reported that attackers impersonate IT/helpdesk staff, direct employees to realistic login pages, and use real-time interaction (including guiding victims to approve push prompts or provide one-time codes) to authenticate and then **enroll attacker-controlled devices into MFA**. After account takeover, the actor pivots through **Okta, Microsoft Entra, or Google** SSO dashboards to rapidly access downstream SaaS services (e.g., *Salesforce*, *Microsoft 365/SharePoint*, *DocuSign*, *Slack*, *Atlassian*, *Dropbox*, *Google Drive*), turning a single compromised identity into broad cloud data access. Separately, **Bumble** reported a phishing-driven compromise of a **contractor account**, after which ShinyHunters allegedly claimed theft of ~**30 GB** of data—reported as largely internal files sourced from **Google Drive** and **Slack**—while Bumble stated there was no evidence of exposure of user chats or profiles. Reporting also tied ShinyHunters to other claimed or alleged thefts affecting consumer and enterprise brands (including Match Group properties such as *Hinge*, *Match*, and *OkCupid*), consistent with the broader pattern of leveraging compromised identities and SaaS access paths for data exfiltration and extortion leverage.
Jun 29, 2026
ShinyHunters has broadened its operations from data theft into a wider cloud-focused extortion campaign targeting enterprise SaaS and identity platforms, with reported intrusions involving **Okta**, **Salesforce**, cloud management systems, and CI/CD environments. Public reporting links the group to phishing, **vishing**, brute-force activity, exploitation of internet-facing applications including `CVE-2021-35587` and the Oracle PeopleSoft zero-day `CVE-2026-35273`, abuse of OAuth tokens, and theft of assets such as BrowserStack API keys that could enable supply-chain compromise. Researchers also reported insider recruitment efforts aimed at personnel with access to Okta, Microsoft SSO, Citrix VPN, GitHub, and GitLab, while the group allegedly uses leak sites and services such as LimeWire to pressure victims into seven-figure payments or sell stolen datasets. The FBI separately warned that ShinyHunters claimed responsibility for a disruptive attack on an online Learning Management System used by educational institutions and students across the United States, underscoring the group’s reach beyond traditional enterprise victims. According to the alert, the actors specialize in large-scale breaches and extortion and may follow intrusions with extortion emails, threatening texts, phone calls, impersonation, spearphishing, and even swatting, sometimes falsely claiming to hold compromising material. MITRE and industry reporting also associate ShinyHunters with aliases including **UNC6240** and **Bling Libra**, ties to **The Com** and overlaps with **Scattered Spider**, and note signs the group may be moving toward ransomware through a reported `shinysp1d3r` platform with ESXi encryption capability.
Aug 10, 2026
Google-owned **Mandiant** reported an expansion in **ShinyHunters**-style intrusions using **voice phishing (vishing)** and spoofed credential-harvesting sites to steal **SSO credentials** and **MFA codes**, enabling unauthorized access to cloud **SaaS** environments. Mandiant tracked the activity across multiple clusters (**UNC6661**, **UNC6671**, and **UNC6240** / *ShinyHunters*) and assessed the objective as data theft from cloud applications (including internal communications) followed by **extortion**, with some incidents involving escalatory pressure such as **harassment of victim personnel**. In observed tradecraft, operators impersonated IT staff, directed employees to phishing links under the pretext of updating MFA settings, then used captured credentials to enroll attacker-controlled devices for MFA. Separate reporting characterized the same campaign as a broad vishing operation with **hundreds of organizations** in scope, reinforcing that the activity is not limited to a single SaaS provider and is focused on identity-layer compromise rather than software exploitation. Other items in the set were unrelated: a supply-chain compromise of *eScan* antivirus update infrastructure distributing a backdoor, a Fortinet write-up on **Interlock** ransomware tradecraft, an article on EU vulnerability identifier policy, and general security-awareness/detection-engineering content; these do not describe the ShinyHunters vishing activity and should not be treated as part of the same incident thread.
Jun 29, 2026