Threat reportPhishingTL-2026-1685
ShinyHunters-Impersonation Sextortion Scam Abuses Emails From 8 Prior Data Leaks, Demands $2,000
ShinyHunters-Impersonation Sextortion Scam Abuses Emails (TL-2026-1685), also tracked as ShinyHunters Impersonation Sextortion Scam, is a low-severity phishing campaign, first published 2026-07-25. It has no confirmed attribution, affects Amtrak Salesforce CRM customer records, maps to 17 MITRE ATT&CK techniques (T1070, T1078, T1190), and is covered by 9 detection rules and 20 indicators of compromise.
- Severity
- LOWAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-1685
- Threat ID
- TL-2026-1685
- Also known as
- ShinyHunters Impersonation Sextortion Scam
- Severity
- LOW
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- financial-services, transport, retail, home-security, food-service, publishing, education, consumer
- Target regions
- united states of america
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in ShinyHunters-Impersonation Sextortion Scam Abuses Emails
Malware and tooling: Modified Google AuraInspector Chrome extension, RapeFlake / RapeForce scanning tool signatures, TruffleHop
How ShinyHunters-Impersonation Sextortion Scam Abuses Emails works
An unidentified threat actor is running a mass sextortion email campaign, active since April 2026, that falsely claims affiliation with the ShinyHunters extortion brand (which publicly denies involvement) to demand $2,000 in cryptocurrency within 48 hours. The scam derives its false credibility entirely from genuine leaked email addresses and breached-company names pulled from eight prior 2025-2026 breaches (Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, McGraw Hill) rather than from any actual device or account compromise.
Since April 2026, victims whose email addresses appear in prior breach dumps have received unsolicited extortion emails with the subject line "Information about your online security," sent from spoofed sender display names reading "ShinyHunters" or "You've Been HACKED." The message falsely claims the sender gained device access "a few months ago" via an exploit reaching the victim's microphone, camera, keyboard, browsing history, photos, conversations, and contact list, and that the victim was recorded visiting adult websites. It demands $2,000 in cryptocurrency (BleepingComputer's sampled emails cite Bitcoin; a separately sampled message analyzed by MyAntiSpyware.com cites Litecoin, wallet ltc1qfpjl5999jwpjq7kvyjld9akaspx69qaxvxrf20) within 48 hours, threatening to send the alleged footage to the victim's contacts, and instructs the victim not to contact police or reset devices -- a classic isolation tactic. No independent technical evidence of device or account compromise has been identified in any reporting; the scam's sole leverage is that the target's real email address and the name of a company that previously suffered a breach appear together, lending superficial plausibility.
All eight named prior breaches occurred within the broader 2025-2026 ShinyHunters/Scattered-LAPSUS$-Hunters (SLSH) extortion wave, which primarily abused Salesforce CRM and Salesforce Experience Cloud environments plus stolen Salesloft Drift OAuth/refresh tokens to exfiltrate customer PII at scale: Betterment (breached 2026-01-09 via vishing/social-engineering against a third-party Salesforce vendor, ~1.4M customer records, no passwords exposed), Substack (unauthorized access window opened ~October 2025, detected 2026-02-03, ~700K records -- reporting on this breach does not explicitly attribute it to ShinyHunters, unlike the other seven), Hallmark Cards/Hallmark Plus (claimed by ShinyHunters 2026-03-31, ~7.9M Salesforce records, leak deadline set for 2026-04-02), Amtrak (claimed by ShinyHunters ~2026-04-11/12 via compromised Salesforce, ~2.1M confirmed accounts added to Have I Been Pwned 2026-04-17, ShinyHunters alleged up to 9.4M records), ADT (Salesforce breached "days after" Amtrak per Techlicious, ~5.5M records via Salesforce Experience Cloud misconfiguration), Panera Bread (~5.1M accounts via Salesforce Experience Cloud misconfiguration), CarGurus (named victim, Salesforce-linked), and McGraw Hill (publicly confirmed 2026-04-14 following a ShinyHunters extortion threat; McGraw Hill characterized exposed data as "limited and non-sensitive" while ShinyHunters claimed 45M PII records, a claim not independently verified).
ShinyHunters (aliases/overlapping clusters tracked as UNC6240, UNC6395, UNC6661, UNC6671, UNC6040, and converging with Scattered Spider/Lapsus$ under the "ShinySp1d3r"/SLSH umbrella) publicly denied any role in the sextortion emails when contacted by BleepingComputer. Betterment separately confirmed awareness of the scam, called it "a common extortion scam," and advised customers not to pay. Victim reports have surfaced on Reddit, Facebook groups, and the Better Business Bureau. The pattern matches the long-running, low-technical-sophistication "automated sextortion" scam family (e.g., the 2018 "I know your password" wave and the pattern documented nationally by New York State Police), refreshed here with a topical, credible-sounding brand name and genuinely leaked email/company pairings to raise conversion rates. Severity is assessed LOW because no technical intrusion, malware, or account takeover is confirmed -- the risk is financial/psychological (fear-driven cryptocurrency payment) rather than system compromise -- but the campaign is tracked for SOC awareness/notification purposes and for correlation against the eight source breaches and the wider ShinyHunters activity cluster.
MITRE ATT&CK techniques used in TL-2026-1685
Defense Evasion
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing
Collection
T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Credential Access
T1528 Steal Application Access Token
defense-impairment
T1556 Modify Authentication Process
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1588 Obtain Capabilities
Reconnaissance
T1589 Gather Victim Identity Information; T1597 Search Closed Sources
reconnaissance
T1598 Phishing for Information
Impact
stealth
Affected products and versions in ShinyHunters-Impersonation Sextortion Scam Abuses Emails
- Amtrak — Salesforce CRM customer records
Vulnerable versions: ~2.1M accounts exposed; claimed by ShinyHunters ~2026-04-11/12; added to HIBP 2026-04-17 - Hallmark Cards / Hallmark Plus — Salesforce customer + internal records
Vulnerable versions: ~7.9M records; claimed by ShinyHunters 2026-03-31 - Substack — User account records
Vulnerable versions: ~700K records; unauthorized access window ~Oct 2025, detected 2026-02-03; not confirmed as ShinyHunters-attributed - Betterment — Salesforce-hosted marketing/operations customer data
Vulnerable versions: ~1.4M customer records; breached 2026-01-09 via third-party vendor social engineering - CarGurus — Salesforce-linked customer records
Vulnerable versions: Named ShinyHunters-cluster victim, 2026 - ADT — Salesforce Experience Cloud customer records
Vulnerable versions: ~5.5M records exposed via Salesforce Experience Cloud misconfiguration - Panera Bread — Salesforce Experience Cloud customer records
Vulnerable versions: ~5.1M accounts exposed via Salesforce Experience Cloud misconfiguration - McGraw Hill — Salesforce-hosted internal/customer data
Vulnerable versions: Breach confirmed 2026-04-14; ShinyHunters claimed 45M records (unverified); McGraw Hill states data was limited/non-sensitive
Remediation for ShinyHunters-Impersonation Sextortion Scam Abuses Emails
Immediate actions
- Do not reply to or pay the ransom demand; preserve the full email including headers as evidence.
- Report the email to the receiving mail provider as phishing/extortion and file a complaint with the FBI IC3 (ic3.gov) or a local FBI field office.
- Block the sender display names ('ShinyHunters', "You've Been HACKED"), the subject line 'Information about your online security', and the cited wallet address ltc1qfpjl5999jwpjq7kvyjld9akaspx69qaxvxrf20 at the email gateway / threat-intel blocklist.
Workarounds
- Enable two-factor authentication on email accounts as general account-takeover hygiene, independent of this specific scam.
- Reassure affected individuals that no verified webcam/microphone/device compromise underlies these emails; a routine antivirus/EDR scan can be offered for peace of mind but is not required to neutralize the threat.
Longer-term hardening
- Build email-gateway detection rules on the observed subject-line and spoofed-sender-name pattern to catch campaign variants before they reach inboxes.
- Run recurring breach-exposure checks (e.g., Have I Been Pwned) for staff/customer emails against the eight named source breaches (Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, McGraw Hill) to proactively identify likely future targets.
- Add this campaign as a documented case study in security-awareness training illustrating how attackers reuse public breach data purely for social-engineering credibility, without any real compromise.
Timeline of ShinyHunters-Impersonation Sextortion Scam Abuses Emails
- Unauthorized access window opens at Substack (detected months later); one of eight breaches later mined for email addresses reused in this sextortion campaign.
- Betterment breached via social engineering/vishing against a third-party Salesforce vendor; ~1.4M customer records exposed (names, emails, some addresses/phone/birth dates).
- Substack breach detected; ~700K user records exposed (breach not independently confirmed as ShinyHunters-attributed).
- ShinyHunters claims breach of Hallmark Cards/Hallmark Plus, ~7.9M Salesforce records; leak deadline set for 2026-04-02.
- Sextortion email campaign impersonating ShinyHunters begins circulating, targeting individuals whose emails appear in the named prior breaches.
- ShinyHunters publicly claims the Amtrak breach via compromised Salesforce; alleges up to 9.4M records.
- McGraw Hill publicly confirms a data breach following a ShinyHunters extortion threat, traced to a Salesforce environment misconfiguration.
- Amtrak breach dataset (~2.1M confirmed accounts) added to Have I Been Pwned.
- MyAntiSpyware.com publishes analysis of a sampled scam email variant citing a $2,000 Litecoin demand and wallet address ltc1qfpjl5999jwpjq7kvyjld9akaspx69qaxvxrf20.
- BleepingComputer publishes report confirming the campaign's use of all eight named breach sources, ShinyHunters' denial of involvement, and Betterment's public customer advisory.
Sources cited for ShinyHunters-Impersonation Sextortion Scam Abuses Emails
- ShinyHunters data leaks fuel $2,000 sextortion email scam
- Fake or Real? We are the ShinyHunters hacking group Email Scam Explained
- ShinyHunters Hacking Group Email Scam: What This Fake Sextortion Message Really Means
- Betterment data breach exposes 1.4 million customers
- ShinyHunters Leak Alleged Data of Millions From SoundCloud, Crunchbase and Betterment
- ShinyHunters Threat Actor Profile: TTPs, IoCs & Attacks
- McGraw-Hill Salesforce Data Breach 2026: Analysis of ShinyHunters Extortion and Cloud Misconfiguration Risks
- Amtrak quietly loses 2M customer records – and hasn't warned anyone
- Substack Data Breach Leaks Nearly 700,000 User Records
- New York State Police Warns of Nationwide Automated Sextortion Scams
- 2025 IC3 Annual Report
- ShinyHunters claims 1.5 billion Salesforce records stolen in Drift hacks
- ShinyHunters Claim Hallmark as Next Victim: 8M Salesforce Records Compromised
Detection coverage for TL-2026-1685
As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1685 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.