# Sextortion Scammers Impersonate ShinyHunters, Exploit Leaked Breach Data for Bitcoin Extortion

> Opportunistic scammers are mass-mailing sextortion emails that impersonate the ShinyHunters extortion brand, citing real data leaks (Amtrak, Hallmark, ADT, Substack, Betterment, CarGurus, Panera Bread, McGraw Hill, Canvas/Instructure) to falsely claim device/webcam compromise and demand $2,000 in Bitcoin within 48 hours. ShinyHunters denied involvement when contacted by researchers, the cited wallet showed zero blockchain activity, and no malware or actual recording capability was found — this is pure social engineering built on the credibility of someone else's breach.

- **Published:** 2026-07-27T00:00:00Z
- **Last reviewed:** 2026-07-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1722
- **ID:** TL-2026-1722
- **Severity:** LOW
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Beginning in approximately April 2026 and continuing through at least late July 2026, threat actors unaffiliated with the ShinyHunters extortion brand sent mass sextortion emails under the subject line "Information about your online security." The messages falsely claim the sender is ShinyHunters, that the group compromised the recipient's devices months earlier, and that an 'exploit' was installed granting access to the microphone, camera, keyboard, photos, browsing history, conversations, and contact list. The email alleges the victim was recorded visiting adult websites and threatens to distribute the footage to the victim's contacts, colleagues, and family unless $2,000 in Bitcoin is sent to a wallet address within 48 hours. Malwarebytes (Pieter Arntz) and BleepingComputer independently confirmed no malware, exploit, or actual device/webcam compromise underlies the threats — the campaign's only real ingredient is that the targeted email addresses genuinely appear in prior ShinyHunters-attributed data breaches (Amtrak, Hallmark, ADT, Substack, Betterment, CarGurus, Panera Bread, McGraw Hill, and the Canvas/Instructure LMS breach affecting California's 116 community colleges plus Stanford, UC campuses, USC, and all 22 CSU campuses). ShinyHunters denied involvement when contacted by both outlets and may have already abandoned direct extortion of some of these victims before the leaked datasets reached the scammers running this campaign; sender addresses use throwaway display names such as 'ShinyHunters' or 'You've Been HACKED' rather than any infrastructure tied to the actual group. BleepingComputer confirmed for at least some recipients that their targeted email address was indeed present in data ShinyHunters had previously leaked, explaining how the lure achieves false credibility without any new compromise. The cited Bitcoin wallet (18eiQXQdF3WftbaxkNqNARMgb45mw7rr6W) showed no blockchain transaction activity as of reporting, indicating low payment yield to date. Context: ShinyHunters operates as part of the 'Scattered Lapsus$ Hunters' criminal alliance (with Scattered Spider and Lapsus$), which since mid-2025 has run a wave of Salesforce-focused extortion intrusions — Scattered Spider typically supplies initial access via vishing/help-desk social engineering, impersonates Salesforce Data Loader as a malicious connected OAuth app, and abuses Okta SSO trust, while ShinyHunters handles exfiltration via Salesforce's own bulk/API export tooling, leak-site publication, and negotiation. The Hallmark (March 2026, ~1.7M unique emails), Amtrak (April 2026, 2.1M-9.4M records), ADT (Okta SSO compromise via vishing, April 2026), and Canvas/Instructure (April 29, 2026 intrusion, ~275M users / 3.65TB claimed) breaches all trace to this same intrusion pattern — including lookalike phishing/SSO-login domains registered to support the help-desk vishing pretext — before their data was scraped and repurposed by unrelated sextortion operators for this campaign. Reports of the scam surfaced on Reddit, Facebook, and the Better Business Bureau complaint boards, and a California community-college outlet (The Advocate) separately reported on Canvas-breach fallout. This threat carries no exploitation or malware component and is tracked for SOC awareness / user-reporting triage rather than technical detection engineering, given the reuse of high-profile breach data as a credibility lure in a financially motivated mass-phishing/extortion scam.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1597 Search Closed Sources
- T1588 Obtain Capabilities
- T1585 Establish Accounts
- T1650 Acquire Access
- T1583 Acquire Infrastructure
- T1566 Phishing
- T1199 Trusted Relationship
- T1598 Phishing for Information
- T1684.001 Impersonation
- T1550 Use Alternate Authentication Material
- T1621 Multi-Factor Authentication Request Generation
- T1078 Valid Accounts
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Sextortion scammers are exploiting ShinyHunters' data leaks](https://www.malwarebytes.com/blog/scams/2026/07/sextortion-scammers-are-exploiting-shinyhunters-data-leaks)
- [ShinyHunters data leaks fuel $2,000 sextortion email scam](https://www.bleepingcomputer.com/news/security/shinyhunters-data-leaks-fuel-2-000-sextortion-email-scam/)
- [ShinyHunters Data Leaks Used in $2,000 Sextortion Email Scam](https://www.technadu.com/shinyhunters-name-gets-hijacked-for-a-new-2000-sextortion-scam/631941/)
- [2026 Canvas data breach](https://en.wikipedia.org/wiki/2026_Canvas_data_breach)
- [Hallmark data breach exposed information of 1.7 million accounts](https://cyberinsider.com/hallmark-data-breach-exposed-information-of-1-7-million-accounts/)
- [Amtrak data breach exposes over 2 million customer records](https://www.upguard.com/news/amtrak-data-breach-2026-04-30)
- [ADT Salesforce Data Breach 2026: ShinyHunters Compromise Okta SSO via Vishing Attack](https://www.rescana.com/post/adt-salesforce-data-breach-2026-shinyhunters-compromise-okta-sso-via-vishing-attack)
- [A Cybercrime Merger Like No Other — Scattered Spider, LAPSUS$, and ShinyHunters Join Forces](https://thehackernews.com/2025/11/a-cybercrime-merger-like-no-other.html)
- [ShinyHunters Wage Broad Corporate Extortion Spree](https://krebsonsecurity.com/2025/10/shinyhunters-wage-broad-corporate-extortion-spree/)
- [Trinity of Chaos: The LAPSUS$, ShinyHunters, and Scattered Spider Alliance Embarks on Global Cybercrime Spree](https://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree)
- [California colleges went big on online learning tools. Then the worst happened](https://timesofsandiego.com/education/2026/05/13/california-canvas-worst-happened/)
- [Student, faculty data ransomed by hacker group in Canvas breach](https://cccadvocate.com/15297/showcase/student-faculty-data-ransomed-by-hacker-group-in-canvas-breach/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1722