# ShinyHunters Evolves TTPs: Vishing and Login Harvesting for SSO/MFA Bypass

> ShinyHunters/Scattered Spider has undergone the most dramatic TTP evolution of any cybercriminal group in the 2022-2026 period, progressing from credential stuffing and database exploitation (2020-2021) to SIM swapping and cryptocurrency theft (2022) to sophisticated vishing-based social engineering targeting IT help desks for SSO/MFA bypass (2023-2026). This threat tracks the TTP EVOLUTION and DEFENSIVE DETECTION of vishing-based attacks: how to detect call center social engineering, SSO token theft/replay, MFA fatigue bombing, SIM swap indicators, and the attacker's shift to targeting human trust rather than technical vulnerabilities. Distinct from TL-0013 (the cloud data theft campaign itself), this threat focuses on the evolving attack methodology and how defenders must adapt detection to counter each generation of ShinyHunters TTPs.

- **Published:** 2026-02-03T11:36:00Z
- **Last reviewed:** 2026-02-03T11:36:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0054
- **ID:** TL-2026-0054
- **Severity:** HIGH (CVSS 8.1)
- **Category:** THREAT_ACTOR
- **Status:** ACTIVE
- **Actor:** ShinyHunters (France)
- **Detections:** 15 · **IOCs:** 38 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ShinyHunters TTP Evolution: From Script Kiddie to ALPHV Affiliate — Detecting the Vishing Kill Chain

The Evolution Timeline — 5 Generations of TTPs:

Generation 1 (2020-2021): Database Exploitation & Credential Stuffing
- ShinyHunters emerged selling stolen databases on RaidForums
- Targeted exposed Git repositories, misconfigured cloud storage (S3/Azure Blob)
- Automated credential stuffing against web applications using leaked credential combo lists
- Monetization: selling databases on darknet forums (Tokopedia 91M, Wattpad 271M, Mashable 5.2M)
- Detection: standard perimeter defense, WAF rules, login anomaly detection
- No social engineering component — purely technical exploitation

Generation 2 (2022): SIM Swapping & Cryptocurrency Theft
- Pivoted to targeting mobile carriers for SIM swaps
- Used SIM control to bypass SMS-based MFA on cryptocurrency exchanges
- Targeted high-net-worth individuals for cryptocurrency theft
- Built relationships with telecom insiders for reliable SIM swaps
- Detection: SIM swap alerts from carriers, login from new device after phone number change
- First social engineering component — but targeted at carrier employees, not victims directly

Generation 3 (2023): Vishing & IT Help Desk Social Engineering
- FUNDAMENTAL SHIFT: attacking the human trust layer instead of technical vulnerabilities
- Posed as employees calling IT help desk to reset passwords and MFA
- Posed as IT help desk calling employees to harvest credentials
- Used stolen personal information (LinkedIn, data broker purchases) for impersonation
- Native English speakers — no accent barriers in phone-based social engineering
- Targeted: MGM Resorts, Caesars Entertainment, Twilio, Mailchimp, Cloudflare
- Monetization: data extortion, ALPHV/BlackCat ransomware affiliate
- Detection: EXTREMELY DIFFICULT — phone calls leave no traditional logs

Generation 4 (2024-2025): SSO Federation Hijacking & MFA Device Registration
- Added federated identity provider to victim SSO tenant
- Activated automatic account linking — all victim accounts accessible via attacker IdP
- Registered attacker-controlled devices for MFA (TOTP/push) to maintain persistence
- Monitored victim incident response via Slack/Teams/Exchange email rules
- Used AiTM (adversary-in-the-middle) phishing for session token theft
- Enrolled in victim VPN using stolen credentials + registered MFA device
- Detection: SSO configuration changes, new IdP federation, MFA device registration anomalies

Generation 5 (2025-2026): AI-Assisted Vishing & Deep Integration
- AI voice cloning for more convincing impersonation (emerging)
- Automated reconnaissance using LLMs to profile targets and generate pretexts
- Cross-referencing multiple data breaches for comprehensive victim profiles
- Targeting cloud infrastructure (vSphere/ESXi) for maximum impact
- DragonForce ransomware deployment alongside data extortion
- Physical threats against employees who resist social engineering
- Detection: AI voice detection (nascent), behavioral analytics for anomalous admin actions

The Vishing Kill Chain — What Defenders Must Detect:

Phase 1 — Reconnaissance:
- OSINT gathering: LinkedIn profiles, org charts, internal naming conventions
- Data broker purchases: phone numbers, home addresses, personal details
- Previous breach data: passwords, security questions, personal identifiers
- Internal documentation: help desk procedures, password reset policies, MFA enrollment steps
- Detection: Monitoring for unusual data access patterns in OSINT-accessible corporate information

Phase 2 — Social Engineering Execution:
- Call to help desk impersonating employee → password reset + MFA enrollment
- Call to employee impersonating IT staff → credential harvesting + RMM tool installation
- SMS phishing with AiTM login portal → session token capture
- MFA fatigue bombing → push notification acceptance
- SIM swap via telecom insider → SMS MFA bypass
- Detection: Help desk call verification (callback to registered number), anomalous password resets, MFA enrollment from new device

Phase 3 — Initial Access:
- Login with reset credentials + attacker-registered MFA
- VPN enrollment with stolen session tokens
- RMM tool (AnyDesk/TeamViewer/Splashtop) providing direct access
- AiTM-captured session token replay
- Detection: Login from unusual location/device, VPN connection from unregistered device, RMM tool installation without IT ticket

Phase 4 — Persistence & Escalation:
- Register new MFA device for the compromised account
- Add federated IdP to SSO tenant for persistent access
- Create new admin accounts in Azure AD/Entra ID
- Modify mailbox rules to suppress security alerts
- Disable/modify EDR via compromised security admin accounts
- Detection: MFA device registration, SSO federation changes, new cloud admin accounts, mailbox rule creation, EDR policy changes

Phase 5 — Data Theft & Impact:
- Bulk export from SharePoint/OneDrive/code repositories/databases
- Data staging in centralized location before exfiltration
- Exfiltration to MEGA.NZ or attacker-controlled cloud storage
- Ransomware deployment (ALPHV/BlackCat, DragonForce) on ESXi servers
- Extortion: pay or data published on leak site
- Detection: Unusual data downloads, bulk export events, connections to MEGA.NZ, ESXi encryption events

Why Vishing Defeats Traditional Security:

1. No digital artifact at point of attack — phone calls don't generate SIEM events
2. Exploits organizational trust (help desk MUST help employees)
3. Native English speakers eliminate accent-based suspicion
4. Stolen PII makes impersonation highly convincing
5. MFA fatigue works because users are trained to expect MFA prompts
6. Help desk staff are measured on resolution speed, not security scrutiny
7. Traditional security awareness training focuses on phishing emails, not phone calls

## MITRE ATT&CK

- T1566.004 Spearphishing Voice
- T1056.003 Web Portal Capture
- T1098.001 Additional Cloud Credentials
- T1556.006 Multi-Factor Authentication
- T1566 Phishing
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1621 Multi-Factor Authentication Request Generation
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1598 Phishing for Information
- T1098 Account Manipulation
- T1136 Create Account
- T1484 Domain or Tenant Policy Modification
- T1684.001 Impersonation
- T1070 Indicator Removal
- T1564 Hide Artifacts
- T1087 Account Discovery
- T1580 Cloud Infrastructure Discovery
- T1538 Cloud Service Dashboard
- T1550 Use Alternate Authentication Material
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1114 Email Collection
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1657 Financial Theft
- T1204 User Execution
- T1219 Remote Access Tools
- T1583 Acquire Infrastructure
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1110 Brute Force
- T1606 Forge Web Credentials
- T1528 Steal Application Access Token
- T1056 Input Capture
- T1137 Office Application Startup

## Sources

- [CISA/FBI — Scattered Spider Joint Advisory AA23-320A (Updated July 2025)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)
- [Microsoft — Octo Tempest Crosses Boundaries: Extortion, Encryption, Destruction](https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/)
- [MITRE ATT&CK — Scattered Spider Group G1015](https://attack.mitre.org/groups/G1015/)
- [CrowdStrike — Scattered Spider Escalates Attacks](https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/)
- [Google Mandiant — Defending vSphere from UNC3944](https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944)
- [Google Mandiant — UNC3944 Proactive Hardening Recommendations](https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations)
- [CrowdStrike — Analysis of Intrusion Campaign Targeting Telecom and BPO Companies](https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/)
- [Check Point — Exposing Scattered Spider: New Indicators for Enterprise and Aviation Threats](https://blog.checkpoint.com/research/exposing-scattered-spider-new-indicators-highlight-growing-threat-to-enterprises-and-aviation/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0054