Gotta breach 'em all! The journey of ShinyHunters

Sekoia's TDR report traces the evolution of the ShinyHunters brand (later operating as Scattered Lapsus$ Hunters) from 2020–2026, documenting large-scale data-theft and extortion campaigns—ranging from exposed GitHub tokens and S3 buckets to MFA-less Snowflake accounts, OAuth abuse against Salesforce, and zero-day Oracle PeopleSoft exploitation—detailing victims, arrests, tooling, IoCs, and practical detection queries.