Mandiant Reports ShinyHunters Exploiting SSO for Cloud Data Theft

Mandiant has reported a series of attacks attributed to the ShinyHunters group, which are primarily focused on stealing data from SaaS applications through sophisticated vishing techniques. The attacks involve impersonating corporate IT staff and directing employees to phishing sites that mimic legitimate login portals. Once the attackers gain access to SSO credentials and MFA codes, they can authenticate and enroll their own devices, allowing them to access sensitive data across various platforms.

Recent incidents have shown that the attackers target major services such as Salesforce, Microsoft 365, and Google Drive, exploiting the centralized nature of SSO dashboards. Mandiant has tracked these activities under threat clusters labeled UNC6661, UNC6671, and UNC6240, indicating a coordinated effort among multiple threat actors. The ShinyHunters group has confirmed their involvement in these attacks, which have escalated to include data leaks following successful breaches.

During these attacks, Mandiant has observed various tactics, including the use of advanced phishing kits that allow attackers to interact with victims in real-time. For instance, attackers can relay stolen credentials while on the phone, triggering legitimate MFA challenges and instructing victims on how to respond. This method significantly increases the likelihood of successful account compromises.

In one notable case, attackers utilized a Google Workspace add-on called ‘ToogleBox Recall’ to delete emails and obscure their activities after gaining access to an Okta customer account. This highlights the lengths to which attackers will go to maintain their foothold in compromised environments.

Implications for Organizations

The rise of these vishing attacks underscores the importance of robust security measures for organizations relying on SSO and MFA. Companies should be vigilant about monitoring for unusual login activities and unauthorized access attempts. Mandiant recommends specific behavior detections, such as rapid data exfiltration following SSO account compromises and unexpected OAuth authorizations.

Organizations must also educate employees about the risks of vishing and the importance of verifying requests for sensitive information. Implementing additional layers of security, such as user behavior analytics and enhanced logging, can help detect and mitigate these threats before data theft occurs.

As the ShinyHunters group continues to evolve their tactics, organizations must remain proactive in their cybersecurity strategies to safeguard against these sophisticated attacks.

• ShinyHunters: A group known for exploiting SSO vulnerabilities to steal data from organizations.
• Okta: An identity management service targeted in these attacks, allowing attackers to gain access to multiple applications.
• Salesforce: A primary target for ShinyHunters, where sensitive customer data can be compromised.
• ToogleBox Recall: A Google Workspace add-on used by attackers to delete emails and hide their activities.
• UNC6661: A threat cluster identified by Mandiant associated with these vishing attacks.