Mandiant details how ShinyHunters abuse SSO to steal cloud data

Mandiant and Google Threat Intelligence report that ShinyHunters and affiliated clusters (UNC6661, UNC6671, UNC6240) conduct targeted vishing attacks combined with advanced phishing kits to steal SSO credentials and MFA codes, enroll attacker MFA devices, pivot into Okta/Microsoft Entra/Google SSO dashboards and mass-exfiltrate SaaS data (Salesforce, M365, SharePoint, DocuSign, etc.) for extortion; the report includes observed IOCs, phishing domain naming patterns, examples of logs, and recommended hardening and detection controls.