Mandiant details how ShinyHunters abuse SSO to steal cloud data

ShinyHunters conducts targeted voice phishing (vishing) attacks where threat actors impersonate corporate IT staff and direct employees to company-branded phishing sites. These sites use advanced phishing kits with interactive dialogs that capture SSO credentials and MFA codes in real time during phone calls. Attackers relay stolen credentials, trigger MFA challenges, and guide victims through authentication steps including push notifications. Once authenticated, attackers enroll their own MFA devices and access SSO dashboards (Okta, Microsoft Entra, Google) to reach multiple SaaS applications. They use PowerShell scripts for data downloads and tools like ToogleBox Recall to delete security notification emails.