Threat reportPhishingTL-2026-3892
ShinyHunters Cluster A Phishing Infrastructure on Mevspace (Doko's Panel, vishing + AiTM credential capture)
ShinyHunters Cluster A Phishing Infrastructure on Mevspace (TL-2026-3892), also tracked as Doko's Panel, is a high-severity phishing campaign, first published 2026-10-19. It is attributed to ShinyHunters - Cluster A infrastructure with medium confidence, affects Okta Okta Workforce Identity (targeted identity provider), maps to 13 MITRE ATT&CK techniques (T1078.004, T1098.005, T1111), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 1ShinyHunters - Cluster A infrastructure
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-3892
- Threat ID
- TL-2026-3892
- Also known as
- Doko's Panel, ShinyHunters Cluster A, Behind the Panels
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution
- ShinyHunters - Cluster A infrastructure
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- higher education, financial-services, cryptocurrency, retail, real-estate, luxury-goods, telecoms, technology
- Target regions
- North America, australia, Global
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in ShinyHunters Cluster A Phishing Infrastructure on Mevspace
Malware and tooling: scattered lapsus$ hunters, Doko's Panel
How ShinyHunters Cluster A Phishing Infrastructure on Mevspace works
Team Cymru validated active phishing infrastructure consistent with Push Security's ShinyHunters 'Cluster A' reporting: two Mevspace-hosted IPs (AS201814, Poland) tied to roughly 65 victim-themed domains used in vishing-led, operator-driven adversary-in-the-middle capture of identity-provider credentials and MFA codes. Team Cymru does not independently attribute the activity to ShinyHunters from passive telemetry alone.
Team Cymru (published 2026-08-05) used network telemetry to validate Cluster A infrastructure described by Push Security (2026-05-07). Two IPs in the Mevspace AS201814 block 149.50.96.0/22, 149.50.97.174 (34 associated domains) and 149.50.127.228 (32 associated domains), were last seen in the telemetry on 2026-05-07. Associated domains are victim-themed and follow the patterns <target>internal.com, my<target>sso.com, my<target>manager.com, my<target>connect.com and admin./cp. operator subdomains. Themes cover higher education (Yale, University of Pennsylvania), financial services (Shift4, KKR, VanEck, IQ-EQ, Meridian Savings), real estate (Brixmor), luxury goods (LVMH), retail and consumer brands (Nike, Disney, Dick's Sporting Goods, Publix, Petco, JB Hi-Fi, Purple), cryptocurrency platforms (Coinbase, Binance, Nexo, NDAX, Bitpanda, Blofin, CoinTracker, Koinly), telecommunications (Verizon) and Australian Taxation Office tax filing. The host 149.50.97.174 exposed an FTP service on port 21 presenting a self-signed BT-Panel certificate (serial 58:23:e9:3d:a7:48:1e:3e:7f:5c:85:12:15:d9:63:0c:f4:6e:f2:06, valid 2025-10-23 to 2027-03-19). Team Cymru treats the BT-Panel artifact as hosting context rather than attribution evidence. Phishing sites are fronted by Cloudflare, and Binance-themed domains use URL-bar truncation typosquats such as www.binance.com.53253binance.com. Registrar and nameserver fingerprint for Cluster A: NICENIC INTERNATIONAL GROUP CO., LIMITED (parent CNOBIN INFORMATION TECHNOLOGY LIMITED) with nameservers ns0.1984.is and ns1.1984hosting.com.
Per Push Security, the tooling is Doko's Panel, named for its developer's Telegram alias 'Doko'. A client.js script on the victim page pings /backend.php with JSON (action 'ping', token, window_id, page, os, browser). Captured credentials are relayed to operator Telegram channels (sendTelegramMessage()/sendtg(), j.php). The workflow is operator-driven rather than an automated reverse proxy: the victim lands on a gated page with a spinner, the operator accepts the visitor from the admin panel, the victim is shown a cloned login page, and the operator replays credentials to the real identity provider and captures the MFA response (SMS OTP, Google Authenticator TOTP, push approval redirects). The victim is then redirected to a decoy page. Some deployments had no authentication on the admin panel, and one variant could display a Microsoft Teams Meeting ID and passcode to support the vishing pretext. Push reports signs of LLM-assisted code modification. Push also describes Clusters B (Njalla/Tucows, heartbeat variant), C (Cloudflare, Turnstile, passkeysetup.com subdomains) and D (minified variant, passkeyportalsetup.com); these share code heritage with Doko's Panel but appear to be deployed by separate groups.
Per Mandiant/GTIG (2026-01-30), UNC6661 phoned employees while posing as IT staff, directed them to victim-branded credential harvesting sites to 'update MFA settings', then registered attacker-controlled MFA devices and exfiltrated data from SaaS platforms (SharePoint, OneDrive, Salesforce, DocuSign, Slack, Google Workspace, Okta). Follow-on extortion is attributed to UNC6240 (ShinyHunters), based on a shared Tox account, ShinyHunters-branded emails and Limewire-hosted samples. Team Cymru states Cluster A correlates with UNC6661 intrusions plus UNC6240 extortion, but explicitly cautions that passive DNS does not prove common ownership, that numeric-token domains (e.g. 412721coinbase.com) have an unconfirmed operational role, and that dokopanel.com (registered 2026-01-17 via Tucows with Njalla nameservers) is a hosting-layer artifact that does not identify individuals. Details drawn from Push Security and Mandiant reporting are not independently verified here.
MITRE ATT&CK techniques used in TL-2026-3892
Initial Access
T1078.004 Cloud Accounts; T1566.002 Spearphishing Link; T1566.004 Spearphishing Voice
Persistence
Credential Access
T1111 Multi-Factor Authentication Interception
Execution
Collection
T1213 Data from Information Repositories
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583.001 Domains; T1588.002 Tool
Reconnaissance
Impact
Defense Evasion
Affected products and versions in ShinyHunters Cluster A Phishing Infrastructure on Mevspace
Remediation for ShinyHunters Cluster A Phishing Infrastructure on Mevspace
Immediate actions
- Block or alert on the listed Cluster A IPs (149.50.97.174, 149.50.127.228, 149.50.97.144) and domains at DNS, proxy and email gateways
- Hunt DNS and proxy logs for lookalike domains matching <brand>internal.com, my<brand>sso.com, my<brand>manager.com and numeric-token <6-digit><brand>.com patterns
- Alert on newly registered Okta/Entra/Google Workspace MFA devices and on 'Security method enrolled' emails being deleted
- Review OAuth app grants for mail recall/deletion tools (Mandiant observed ToogleBox Recall)
- Alert on sign-ins and admin actions from anonymizing VPN/proxy services (Mullvad, Oxylabs, NetNut, 9Proxy, Infatica, nsocks)
Workarounds
- Restrict IdP sign-in to managed devices and known network egress where feasible
- Disable SMS/TOTP/push enrollment for high-risk roles in favor of FIDO2
Longer-term hardening
- Move workforce identities to phishing-resistant MFA (FIDO2 security keys / passkeys bound to the legitimate origin)
- Harden help-desk identity verification and MFA reset procedures against vishing; train staff that IT will not direct them to sign-in links by phone
- Monitor certificate transparency and passive DNS for brand lookalikes and register defensive domains
- Alert on high-volume SharePoint/OneDrive/Salesforce downloads and bulk keyword searches (poc, confidential, vpn) in SaaS audit logs
Timeline of ShinyHunters Cluster A Phishing Infrastructure on Mevspace
- Per Push Security, the phishing panel tooling became available around August 2025 (month-level date).
- Self-signed BT-Panel certificate presented on 149.50.97.174 port 21 became valid (valid until 2027-03-19).
- Push Security dates Cluster A (Doko's Panel, NiceNIC registrar, Mevspace hosting) from approximately November 2025 through April 2026 (month-level date).
- Per Mandiant, UNC6661 and UNC6671 vishing operations ran in early-to-mid January 2026, followed by mid-January extortion emails from UNC6240 (approximate date).
- dokopanel.com registered via Tucows with Njalla nameservers, per Team Cymru.
- Mandiant/GTIG published 'Vishing for Access', tracking UNC6661, UNC6671 and UNC6240 SaaS data theft; a ShinyHunters-branded leak site emerged in late January.
- Team Cymru notes the earliest Cluster A domain registrations around February 2026, about four months after BT-Panel installation (month-level date).
- Push Security published its analysis of the phishing panel; both Mevspace IPs were last seen in Team Cymru telemetry the same day.
- Team Cymru published network-telemetry validation of Cluster A infrastructure, without independently attributing it to ShinyHunters.
Sources cited for ShinyHunters Cluster A Phishing Infrastructure on Mevspace
- Behind the Panels: Validating ShinyHunters Cluster A Infrastructure Through Network Telemetry
- Push Security: Inside a phishing panel used by ShinyHunters and BlackFile
- Google Cloud / Mandiant GTIG: Vishing for Access - Tracking ShinyHunters-Branded SaaS Data Theft
- Google Cloud: Defense against ShinyHunters-branded SaaS data theft (hardening guide)
- The Hacker News: Mandiant finds ShinyHunters using vishing to steal MFA and breach SaaS platforms
- BankInfoSecurity: Hanging Up on ShinyHunters - Experts Detail Vishing Defenses
- CSO Online: ShinyHunters ramp up new vishing campaign with 100s in crosshairs
- GTI Collection of ShinyHunters-branded campaign IOCs (VirusTotal)
Detection coverage for TL-2026-3892
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3892 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.