ShinyHunters Expands Scope of SaaS Extortion Attacks

Mandiant and Google report that the ShinyHunters cybercrime collective has expanded SaaS-focused extortion operations (clusters UNC6661, UNC6671, UNC6240), using vishing and company‑branded credential‑harvesting sites to capture SSO credentials and MFA codes, register attacker devices, move laterally within cloud environments (Microsoft 365, SharePoint, Slack, Salesforce), exfiltrate sensitive data for leverage in ransom demands, and negotiate via branded extortion messages and messaging platforms; defenders are advised to harden SaaS configurations, monitor phishing domain patterns, and adopt phishing‑resistant authentication.