ShinyHunters-Linked Cybercrime Campaign Targets Over 100 Major Organizations A recent cybercrime campaign attributed to the ShinyHunters group has targeted at least 100 organizations across multiple sectors, including software, finance, healthcare, and energy, according to cybersecurity firm Silent Push. Over the past 30 days, threat actors registered fake domains impersonating high-profile companies such as Atlassian, Adyen, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, GameStop, WeWork, Halliburton, Sonos, and Telstra. The attackers employed voice phishing (vishing) tactics to compromise single sign-on (SSO) accounts, particularly those using Okta and other identity platforms. Using specialized phishing kits, they intercepted credentials and manipulated victims into bypassing multi-factor authentication (MFA) by convincing them to approve push notifications or submit one-time passcodes (OTPs). Okta described the attacks as involving real-time session orchestration, where threat actors guided victims through the authentication process via verbal instructions. While Silent Push identified the infrastructure used in the campaign, it remains unclear whether the attacks successfully breached any systems. However, ShinyHunters has claimed responsibility for data breaches at companies like Betterment, Crunchbase, and SoundCloud, all of which confirmed incidents. The group allegedly stole millions of records from these organizations as part of the Okta SSO vishing campaign. Silent Push attributes the campaign to Scattered LAPSUS$ Hunters, a collective formed last year by members of Lapsus$, Scattered Spider, and ShinyHunters, based on observed tactics, techniques, and procedures (TTPs). The incident follows recent warnings from Google and others about rising vishing and phishing attacks targeting identity platforms.

Adyen Hit by Multi-Wave DDoS Attack, Disrupting European Payment Services Dutch payment processor Adyen experienced a distributed denial-of-service (DDoS) attack this week, causing temporary disruptions to its services across Europe. The company detected the incident shortly before 7 p.m. CEST (1 p.m. EDT) on Monday, when monitoring systems flagged unusually high error rates in its European payment infrastructure. According to Adyen’s Chief Technology Officer, Tom Adams, the attack unfolded in three distinct waves, each with evolving patterns that required rapid adjustments to mitigation efforts. At its peak, the assault generated millions of requests per minute from a globally distributed and shifting set of IP addresses. While core systems remained operational, certain services including onboarding and money transfers were degraded, leading to failed or delayed transactions for some customers. Adyen, which serves major clients like Uber, eBay, and Spotify, confirmed that the incident was resolved by 3 a.m. CEST on Tuesday. The company stated it would conduct a detailed post-incident review for customers, outlining the attack’s scope and long-term prevention measures, though no timeline was provided. DDoS attacks, a common threat to financial services, typically aim to overwhelm systems rather than steal data. While such attacks rarely compromise internal operations at cyber-mature organizations, they can erode customer trust and disrupt service availability. Adyen did not disclose whether U.S. operations were affected.