ShinyHunters claim to be behind SSO-account data theft attacks

ShinyHunters is conducting voice-phishing (vishing) attacks that impersonate IT support to trick employees into entering credentials and MFA codes on dynamic phishing pages that update in real time; compromised SSO accounts then provide access to connected enterprise SaaS services (e.g., Salesforce, Microsoft 365, Google Workspace) for data harvesting and extortion, and the group claims responsibility while leveraging previously stolen breach data to target victims.