Mandiant Finds ShinyHunters-Style Vishing Attacks Stealing MFA to Breach SaaS Platforms

Google Mandiant observed an expansion of ShinyHunters-linked extortion activity where multiple clusters (UNC6661, UNC6671, UNC6240) use voice phishing and faux credential-harvesting sites to steal SSO credentials and MFA codes, register attacker MFA devices, and access/exfiltrate sensitive data from SaaS platforms (Okta, SharePoint, OneDrive, Salesforce) for extortion; Google provided hardening and detection recommendations including phishing-resistant MFA, stricter help-desk verification, and enhanced logging.