ShinyHunters Targets Canva and Others in Okta Credential Theft Campaign
- Securityish
- Threats & Incidents
Quick Summary
ShinyHunters has launched a campaign targeting around 100 organizations, including Canva, using Okta single sign-on (SSO) credential theft techniques. This operation involves evolved voice-phishing tactics to compromise SSO credentials and potentially exfiltrate sensitive data. Notably, ShinyHunters claimed to have accessed Crunchbase and Betterment, leaking millions of records, which raises significant concerns about the security of SSO systems and the effectiveness of current authentication measures.
The Securityish Brief
ShinyHunters, a known cybercriminal group, has targeted approximately 100 organizations in a campaign focused on stealing Okta single sign-on (SSO) credentials. Silent Push researchers reported this activity, indicating that companies such as Canva, Atlassian, AppLovin, Epic Games, and others are among those being actively targeted. The campaign has been ongoing for at least the last 30 days, with ShinyHunters confirming that the number of targeted organizations is close to 100.
In this operation, ShinyHunters employs advanced voice-phishing techniques to compromise SSO credentials, allowing them to gain initial access to victim organizations. Once inside, they can pivot into Software as a Service (SaaS) environments to exfiltrate sensitive data. Mandiant’s consulting CTO, Charles Carmakal, noted that the group has approached some victims with extortion demands, indicating a serious threat to the integrity of the organizations involved.
While there is no evidence that any of the targeted companies have been successfully breached, the potential for identity theft and data exfiltration remains high. ShinyHunters has reportedly accessed Crunchbase and Betterment, leaking over 20 million records from Betterment and 2 million from Crunchbase. This highlights the risks associated with SSO systems and the importance of robust security measures.
Why This Matters for Your Security
The ongoing ShinyHunters campaign underscores the vulnerabilities inherent in SSO systems, particularly when combined with social engineering tactics like voice phishing. Organizations must be vigilant in monitoring their systems for signs of unauthorized access and anomalous activity.
Implementing phishing-resistant multi-factor authentication (MFA) solutions, such as FIDO2 security keys or passkeys, is crucial for protecting against these types of identity attacks. Traditional SMS or push-based authentication methods are less effective against social engineering attacks.
Furthermore, organizations should enforce strict app authorization policies and regularly review logs for any unusual API activity or unauthorized device enrollments. This proactive approach can help mitigate the risks associated with credential theft and unauthorized access.
Key Takeaways
- Implement phishing-resistant multi-factor authentication solutions like FIDO2 security keys to enhance account security.
- Regularly monitor logs for anomalous API activity or unauthorized device enrollments to detect potential breaches.
- Educate employees about the risks of voice phishing and how to recognize suspicious communication.
- Review and enforce strict app authorization policies to limit access to sensitive systems.
- Stay informed about ongoing threats and adjust security measures accordingly to protect against evolving attack techniques.
Key Terms & Concepts
- ShinyHunters: In this article, ShinyHunters refers to a cybercriminal group known for targeting organizations to steal credentials.
- Okta: Okta is a platform that provides single sign-on (SSO) services, allowing users to access multiple applications with one set of credentials.
- Multi-Factor Authentication (MFA): MFA is a security measure that requires users to provide two or more verification factors to gain access to a resource.
- Voice Phishing: Voice phishing, or vishing, is a type of social engineering attack where attackers use phone calls to trick individuals into revealing sensitive information.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2026/01/26/shinyhunters_okta_sso_campaign/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
