Several voice-based social engineering attacks have prompted renewed scrutiny of single sign-on ecosystem security assumptions. The cybercrime collective ShinyHunters has publicly announced that it has carried out an extensive campaign to harvest SSO credentials from approximately 100 organizations, signaling an intentional shift toward identity-centered intrusion methods.
As a result of the early disclosures, substantial amounts of data have already been exposed, as leaks have been confirmed to platforms such as SoundCloud, Crunchbase, and Betterment, which have affected tens of millions of user records.
Moreover, the intrusions were not the result of software malfunctions or misconfigurations, but rather carefully executed voice phishing attacks that took advantage of human trust in modern authentication workflows to achieve success.
A growing reality for enterprises is underscored by this tactic. As authentication becomes more centralized via single sign-on providers, compromises of individual identities can result in systemic access to entire SaaS environments, amplifying the scale and impact of these breaches.
Once an employee's single sign-on credentials have been successfully accessed, the impact is extensive beyond the initial account compromise.
By gaining access to a single sign-on identity, attackers will gain access to the organization's broader application ecosystem.
Various SSO platforms, including Okta, Microsoft Entra, and Google, streamline authentication by federating access to a variety of internal and third-party services under a single login, which facilitates streamlining authentication.
As a result of this architecture, usability and administrative control are improved, but risk is also concentrated, as a single breached identity can unlock multiple downstream systems.
The SSO dashboard provides authenticated users with an integrated view of all enterprise applications connected to it, transforming a compromised account into a digital footprint map of the organization.
A number of business-critical applications are commonly integrated into platforms, including Microsoft 365, Google Workspace, Salesforce, SAP, Slack, Atlassian, Dropbox, Adobe, Zendesk, and other software as a service applications.
ShinyHunters and associated actors have exploited this model through targeted voice phishing campaigns, impersonating internal IT personnel, and guiding victims through credential entry and multi-factor authentication challenges on convincingly replicated login portals.
Following authentication, the attackers systematically enumerate all available applications within the SSO environment, and then begin extracting data from each platform, enabling massive data thefts and lateral expansion across interconnected services before security teams may detect any abnormal activity.
In the aftermath of initial access, attackers began targeting cloud-based software-as-a-service environments, which are systematically targeting systems for storing corporate data and internal documents. The objective goes beyond data theft, with stolen information increasingly being utilized for subsequent extortion campaigns following the initial data theft.
Various designations are being tracked by Google Threat Intelligence Group (GTIG), including UNC6661, UNC6671, and UNC6240, reflecting a loosely coordinated but tactically aligned group of operators employing a similar approach to intrusions and monetizations.
The GTIG and Mandiant investigations indicate that activity associated with UNC6661 intensified in mid-January, when attackers posed as internal IT personnel to contact employees within targeted organizations. In addition to being told that multifactor authentication settings would soon be updated, victims were directed to convincingly branded credentials harvesting portals.
It was designed to capture both single-sign-on credentials and MFA codes in real-time, thereby enabling immediate account control. Mandiant confirmed that, in multiple instances, the compromised credentials came from Okta customers, as mentioned in an Okta blog posting describing a campaign employing advanced phishing kits in response to the compromised credentials.
In a subsequent study, researchers attributed follow-up extortion efforts to UNC6240, citing overlapping operational artifacts including the reuse of a common Tox account during negotiations, among others. In late January, a newly established leak site listing alleged victims was published, which described the nature of the stolen information and imposed payment deadlines of 72 hours.
Researchers have previously reported that allegations of compromise have been made against at least five organizations. UNC6671 is exhibiting similar tradecraft in parallel activities.
Throughout the past week, operators connected to this cluster have conducted vishing attacks involving impersonation of IT personnel and real-time credential harvesting.
In spite of the underlying domain infrastructure being similar to that of UNC6661, researchers observed differences in domain registration services, suggesting that operations are separate despite common tools and techniques.
It is believed that these groups are collectively associated with ShinyHunters, which operates under alternative banners such as Scattered Lapsus$ Hunters at times.
The collective is derived from an ecosystem of loosely affiliated cybercriminals known as The Com, whose members have proven to be skilled at telephone social engineering.
An increasingly sophisticated phishing toolkit is at the core of these operations, designed to manage the complete lifecycle of an attack.
The latest kits are capable of generating phishing emails and hosting replicate login pages, as well as relaying captured credentials in real time to attackers—an essential feature of multifactor authentication.
A growing number of advanced frameworks now support voice-enabled phishing, which allows attackers to coordinate live phone calls in conjunction with dynamic manipulations of the victim's browser session Okta researchers have observed that these toolkits can be adjusted on the fly, enabling callers to control which pages are presented to victims according to their scripts as well as with legitimate MFA challenges encountered during the login process.
With this level of orchestration, attackers are able to neutralize most multi-factor authentication (MFA) mechanisms that are not explicitly phishing-resistant. These campaigns are known to target identity platforms, cryptocurrencies, and Okta's own identity and access management services, which serve as authentication hubs for extensive corporate application portfolios, including Google and Microsoft Entra.
It has been demonstrated that phishing pages are closely modeled after legitimate sign-in interfaces, ensuring a seamless experience for victims. According to Okta threat researcher Moussa Diallo, attackers can coordinate on-screen instructions with spoken instructions, even advising victims that they will receive MFA push notifications in advance, thus lending credibility to what would otherwise appear to be an unsolicited authentication request.
However, phishing-resistant MFA technology such as smartcards, FIDO security keys, cryptographic passkeys, and Okta FastPass introduces cryptographic binding between the service and the user, thus reducing the effectiveness of real-time social engineering attacks.
Ultimately, the campaign reinforces the critical lesson that defenders should take away: identity has become the primary attack surface, and human interaction has become one of its most vulnerable components.
Threat actors have refined their abilities to manipulate trust by engaging in real-time voice engagements, challenging traditional assumptions about authentication strength.
In addition to considering the fact that even well-implemented SSO and MFA controls can be undermined when users are persuaded to actively participate in an attack chain, security teams must change both technical and operational strategies to address this risk.
By adopting cryptographically bound authentication mechanisms that are phishing-resistant, organizations can reduce the probability of credential replay in real-time. Furthermore, sustained employee awareness training that recognizes voice phishing as a major threat, rather than a niche variant of email-based scams, is equally important.
The use of clear internal IT communication processes, along with monitoring for anomalous SSO behavior and rapid response playbooks, can further limit the blast radius in the event of compromise. In order to increase resilience against identity-driven attacks, layered controls will need to remain effective even when social engineering is successfully employed.
