ShinyHunters Leads Surge in Vishing Attacks to Steal SaaS Data

**Executive Summary:** Mandiant and other industry researchers are tracking a surge of extortion-focused campaigns tied to ShinyHunters and affiliated clusters that employ sophisticated, human-led vishing and targeted credential-harvesting sites to bypass SSO/MFA, access SaaS environments, exfiltrate sensitive data, and pressure victims with extortion and harassment; the activity has produced large data exposures (millions of records) and leverages custom vishing kits and overlapping threat clusters (UNC6240/UNC6661/UNC6671).