Article Details
Scrape Timestamp (UTC): 2026-01-31 08:01:07.506
Source: https://thehackernews.com/2026/01/mandiant-finds-shinyhunters-using.html
Original Article Text
Click to Toggle View
Mandiant Finds ShinyHunters Using Vishing to Steal MFA and Breach SaaS Platforms. Google-owned Mandiant on Friday said it identified an "expansion in threat activity" that uses tradecraft consistent with extortion-themed attacks orchestrated by a financially motivated hacking group known as ShinyHunters. The attacks leverage advanced voice phishing (aka vishing) and bogus credential harvesting sites mimicking targeted companies to gain unauthorized access to victim environments by collecting sign-on (SSO) credentials and multi-factor authentication (MFA) codes. The end goal of the attacks is to target cloud-based software-as-a-service (SaaS) applications to siphon sensitive data and internal communications and extort victims. The tech giant's threat intelligence team said it's tracking the activity under multiple clusters, including UNC6661, UNC6671, and UNC6240 (aka ShinyHunters), so as to account for the possibility that these groups could be evolving their modus operandi or mimicking previously observed tactics. "While this methodology of targeting identity providers and SaaS platforms is consistent with our prior observations of threat activity preceding ShinyHunters-branded extortion, the breadth of targeted cloud platforms continues to expand as these threat actors seek more sensitive data for extortion," Mandiant noted. "Further, they appear to be escalating their extortion tactics with recent incidents, including harassment of victim personnel, among other tactics." Details of the vishing and credential theft activity are as follows - To counter the threat posed to SaaS platforms, Google has outlined a long list of hardening, logging, and detection recommendations - "This activity is not the result of a security vulnerability in vendors' products or infrastructure," Google said. "Instead, it continues to highlight the effectiveness of social engineering and underscores the importance of organizations moving towards phishing-resistant MFA where possible. Methods such as FIDO2 security keys or passkeys are resistant to social engineering in ways that push-based, or SMS authentication are not."
Daily Brief Summary
Mandiant has detected ShinyHunters using voice phishing to capture SSO credentials and MFA codes, targeting SaaS platforms for data theft and extortion.
The group employs fake credential harvesting sites mimicking legitimate companies, aiming to access sensitive data and internal communications.
Mandiant tracks these activities under clusters UNC6661, UNC6671, and UNC6240, noting potential evolution in tactics or mimicry of past strategies.
The threat actors are expanding their target range across cloud platforms, seeking more sensitive data for extortion purposes.
Recent tactics include harassment of victim personnel, indicating an escalation in extortion methods.
Google advises adopting phishing-resistant MFA solutions, such as FIDO2 security keys, to counteract social engineering threats.
The incidents underscore the effectiveness of social engineering rather than exploiting security vulnerabilities in vendor products.