ShinyHunters Gang Behind Vishing Attacks Targeting SSO Accounts at Okta, Microsoft, and Google The extortion group ShinyHunters has claimed responsibility for a series of voice phishing (vishing) attacks targeting single sign-on (SSO) accounts at Okta, Microsoft Entra, and Google, enabling threat actors to breach corporate SaaS platforms and steal data for extortion. In these attacks, cybercriminals impersonate IT support staff, calling employees and tricking them into entering credentials and multi-factor authentication (MFA) codes on phishing sites mimicking legitimate login portals. Once compromised, the attackers gain access to the victim’s SSO account, which often serves as a gateway to connected enterprise applications, including Salesforce, Microsoft 365, Google Workspace, Dropbox, Slack, and Atlassian. The phishing kits used in these attacks feature real-time control panels, allowing attackers to dynamically adjust phishing pages during calls prompting victims to approve MFA requests or enter one-time codes as needed. Okta confirmed the use of such kits in a recent report, though it declined to comment on the breaches themselves. ShinyHunters told BleepingComputer that it is behind some of the attacks, with Salesforce as its primary target, though other platforms are also exploited. The group leverages stolen employee data including phone numbers, job titles, and names from previous breaches to make social engineering calls more convincing. Recent victims listed on ShinyHunters’ Tor data leak site include SoundCloud, Betterment, and Crunchbase. While SoundCloud and Betterment had previously disclosed breaches, Crunchbase confirmed a new incident involving data exfiltration from its corporate network, though no operational disruptions occurred. The company has engaged cybersecurity experts and law enforcement. Microsoft and Google have not reported evidence of their products being abused in the campaign, with Google stating it has no indication its systems were affected. ShinyHunters disputed Okta’s attribution of a specific phishing kit, claiming its infrastructure was built in-house.