# ShinyHunters-Branded Extortion Campaign Expands with Vishing & SSO Attacks

> ShinyHunters-branded extortion campaign leveraging voice phishing (vishing) and SSO credential theft as primary attack vectors. Distinct from TL-0030 (parent ShinyHunters evolved vishing overview) and TL-0013 (SLSH/ShinyHunters credential marketplace). This threat focuses on the specific vishing TTPs and fake SSO portal mechanics: phone-based pretexting to helpdesk and remote employees, real-time MFA relay via custom phishing pages, SSO portal impersonation for Okta/Azure AD/Google Workspace, and the operational model of 'The Com' — the distributed cybercriminal social network enabling instant collaboration between vishing operators, credential harvesters, and data extortionists. Linked to UNC5537 (Mandiant), Scattered Spider (CrowdStrike), and the Beige Group. The campaign exploits the post-COVID remote work landscape where VPN/SSO portals are the new perimeter.

- **Published:** 2026-02-03T03:25:00Z
- **Last reviewed:** 2026-02-03T03:25:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0045
- **ID:** TL-2026-0045
- **Severity:** HIGH (CVSS 8.2)
- **Category:** THREAT_ACTOR
- **Status:** ACTIVE
- **Actor:** ShinyHunters (France)
- **Detections:** 15 · **IOCs:** 46 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This threat profile covers the ShinyHunters-branded extortion campaign's specific use of voice phishing (vishing) and SSO credential theft — the operational TTPs that enabled breaches of 160+ Snowflake customer organizations, the MGM Resorts casino shutdown, and ongoing corporate extortion campaigns.

Vishing Operations Model:
The campaign operates through 'The Com' — a distributed archipelago of Telegram and Discord channels functioning as a cybercriminal social network. Operators work in coordinated pairs: one caller conducts the social engineering over the phone while a second operator simultaneously uses stolen credentials at the phishing page in real-time. This two-person relay defeats time-based MFA because the one-time code is captured and replayed within its validity window (typically 30-60 seconds).

Vishing TTPs (7 distinct techniques):
1. IT Helpdesk Impersonation: Callers pose as company IT department staff troubleshooting VPN issues. They use company-specific terminology learned from previous failed calls, building a progressively more convincing pretext with each attempt. Target: remote employees.
2. New Hire Pretexting: Attackers create LinkedIn profiles as fake new employees and connect with real employees to build legitimacy. When they call claiming to be from IT, the target can verify the 'employee' exists on LinkedIn/Teams/Slack.
3. MFA Relay in Real-Time: Custom phishing pages request the MFA token alongside username/password. The second operator enters the credentials at the real login portal within seconds, before the time-based code expires.
4. New Hire Targeting: Focused reconnaissance on recently hired employees who are less familiar with company procedures, IT contacts, and security protocols. New hires are statistically more likely to comply with 'IT department' requests.
5. Progressive Reconnaissance: Each failed vishing attempt teaches the attackers more about internal operations — corporate lingo, organizational structure, tool names, employee names. They iterate and improve with each call.
6. Domain Activation/Deactivation: Phishing domains are registered and configured but remain offline until the vishing call begins. The site goes live only during the active call, then is immediately disabled. This defeats abuse reporting that requires a live phishing page.
7. Phone Number Spoofing: Caller ID spoofed to appear as the target company's actual helpdesk number, adding legitimacy to the pretext.

SSO Portal Attacks:
The campaign maintains a factory of fake SSO portals impersonating Okta, Azure AD, Google Workspace, Duo Security, and corporate VPN login pages. Domain naming follows a predictable pattern: [company]-vpn[.]com, [company]-sso[.]com, helpdesk-[company][.]com, [company]-portal[.]com, [company]-employee[.]com, [company]-ticket[.]com. These pages are pixel-perfect clones with working links to legitimate internal resources, making them nearly indistinguishable from authentic login portals. The pages include:
- Real corporate branding and logos scraped from public sites
- Working links to real company resources (HR portal, benefits, intranet)
- MFA prompt that captures and relays the one-time code in real-time
- Session token capture for post-authentication lateral movement
- Custom SSL certificates from Let's Encrypt for the green padlock

The Com Ecosystem:
The broader ecosystem fueling these attacks is 'The Com' — a distributed cybercriminal social network operating across Telegram and Discord. Key characteristics:
- Bounty system: customers pay operators to target specific companies
- Leaderboards: ranked by stolen cryptocurrency holdings and successful hacks
- Specialization: SIM swappers, vishers, phishing page builders, and data brokers collaborate
- Youth recruitment: many operators are teenagers (the MGM hacker was 17, LAPSUS$ member at 15)
- Cross-pollination: members move between cybercrime and harm communities (764, CVLT, Leak Society)
- Brand fluidity: same actors operate under Scattered Spider, ShinyHunters, LAPSUS$, Beige Group, UNC5537 labels

Snowflake Campaign (UNC5537):
The vishing and SSO credential theft directly enabled the Snowflake campaign, where attackers discovered that major corporations stored massive datasets on Snowflake servers protected only by username/password (no MFA). Using credentials obtained via vishing, phishing, and darknet marketplace purchases, UNC5537 breached 160+ organizations including AT&T (110M customer records), TicketMaster, Lending Tree, Advance Auto Parts, Neiman Marcus, and Santander Bank. Private extortion demands were made before public breach disclosure.

MGM Resorts Attack:
The September 2023 MGM casino shutdown — one of the most high-profile cyberattacks in history — began with a single vishing call. A 17-year-old Scattered Spider member called MGM tech support, impersonated an employee, and convinced them to reset an account password. This single social engineering call led to ALPHV/BlackCat ransomware deployment, a week-long casino shutdown, and an estimated $100M+ in losses.

Evolution Timeline:
- 2020: Beige Group pioneers corporate VPN vishing during COVID-19 remote work transition
- 2020: GoDaddy employees social engineered into installing malware via phone calls
- 2021-2022: LAPSUS$ teenage hackers breach EA, Microsoft, NVIDIA, Okta, Samsung, T-Mobile via social engineering
- 2023: Scattered Spider/ALPHV attack on MGM Resorts via single vishing call
- 2023-2024: UNC5537 Snowflake campaign — 160+ orgs breached using stolen credentials
- 2024: ShinyHunters brand adopted for extortion campaigns using same vishing infrastructure
- 2025-2026: Campaign continues with refined SSO portal attacks and expanded targeting

Key Insight: The entire ShinyHunters extortion empire is built on social engineering, not technical exploitation. There are no zero-days, no malware (initially), no network intrusion. A phone call to the right person with the right pretext is sufficient to compromise any organization that relies on SSO/VPN as its security perimeter.

## MITRE ATT&CK

- T1566.004 Spearphishing Voice
- T1557 Adversary-in-the-Middle
- T1098.001 Additional Cloud Credentials
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1589 Gather Victim Identity Information
- T1593 Search Open Websites/Domains
- T1591 Gather Victim Org Information
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1566 Phishing
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1204 User Execution
- T1098 Account Manipulation
- T1528 Steal Application Access Token
- T1621 Multi-Factor Authentication Request Generation
- T1056 Input Capture
- T1552 Unsecured Credentials
- T1550 Use Alternate Authentication Material
- T1684.001 Impersonation
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1657 Financial Theft
- T1565 Data Manipulation
- T1071 Application Layer Protocol
- T1526 Cloud Service Discovery
- T1087 Account Discovery
- T1594 Search Victim-Owned Websites
- T1608 Stage Capabilities
- T1539 Steal Web Session Cookie
- T1606 Forge Web Credentials
- T1556 Modify Authentication Process
- T1036 Masquerading
- T1070 Indicator Removal
- T1580 Cloud Infrastructure Discovery
- T1619 Cloud Storage Object Discovery
- T1074 Data Staged

## Sources

- [SecurityWeek: ShinyHunters-Branded Extortion Activity Expands, Escalates](https://www.securityweek.com/shinyhunters-branded-extortion-activity-expands-escalates/)
- [KrebsOnSecurity — The Dark Nexus Between Harm Groups and The Com](https://krebsonsecurity.com/2024/09/the-dark-nexus-between-harm-groups-and-the-com/)
- [KrebsOnSecurity — Voice Phishers Targeting Corporate VPNs](https://krebsonsecurity.com/2020/08/voice-phishers-targeting-corporate-vpns/)
- [KrebsOnSecurity — AT&T Breach via Snowflake (110M records)](https://krebsonsecurity.com/2024/07/hackers-steal-phone-sms-records-for-nearly-all-att-customers/)
- [KrebsOnSecurity — GoDaddy Employees Social Engineered by Beige Group](https://krebsonsecurity.com/2020/11/godaddy-employees-used-in-attacks-on-multiple-cryptocurrency-services/)
- [CrowdStrike — Scattered Spider Threat Actor Profile](https://www.crowdstrike.com/adversaries/scattered-spider/)
- [Wired — 764 Com Child Predator Network Investigation](https://www.wired.com/story/764-com-child-predator-network/)
- [RCMP — Violent Online Groups Targeting Youth Alert](https://www.rcmp-grc.gc.ca/en/news/2024/rcmp-reminds-canadians-violent-online-groups-targeting-youth)
- [Mandiant — UNC5537 Snowflake Data Theft and Extortion](https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion)
- [CISA — Scattered Spider Advisory AA24-242a](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a)
- [West Midlands Police — Walsall Teenager Arrested (MGM Hacker)](https://www.westmidlands.police.uk/news/west-midlands/news/news/2024/july/walsall-teenager-arrested-in-joint-west-midlands-police-and-fbi-operation/)
- [KrebsOnSecurity — LAPSUS$ Stole T-Mobile Source Code](https://krebsonsecurity.com/2022/04/leaked-chats-show-lapsus-stole-t-mobile-source-code/)
- [Unit 221B — Vishing Gang Research](https://www.unit221b.com/)
- [ZeroFOX — Vishing Domain Intelligence](https://www.zerofox.com/)
- [KrebsOnSecurity — SIM Swapper Abducted and Beaten](https://krebsonsecurity.com/2022/09/sim-swapper-abducted-beaten-held-for-200k-ransom/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0045