The playbook that walks past MFA
On 18 June 2026 Cato Networks' threat research team, Cato CTRL, published a threat actor profile of ShinyHunters. Its central point is that the group's 2025 to 2026 operations rely on trusted identity flows and business logic rather than exploit chains or basic phishing.
In the UNC6040 campaign, according to Cato the attacker called the help desk, impersonated internal IT and guided an employee through a "connectivity troubleshooting" process. That process ended with the employee approving a malicious Salesforce connected app. Once the app was approved, the attacker held an OAuth token carrying the user's permissions. Cato notes that this required no password spraying, no exploit chain and no compromise of MFA: the user's own approval did the work.
A related cluster, UNC6395, removed the social engineering step altogether. It used stolen OAuth tokens tied to trusted integrations such as Salesloft Drift, which gave access without malware, login prompts or suspicious endpoint artefacts.
Cato's conclusion is that strengthening user MFA alone is not enough, because the weakness sits in connected applications rather than in the login.
Who is ShinyHunters in 2026
ShinyHunters made its name in 2020 as a high-volume broker of stolen databases. Since then, according to Cato, the ecosystem around it has been hit repeatedly: RaidForums was seized, BreachForums was seized twice, the group's founder was extradited and sentenced, and several high-profile administrators were arrested in France in 2025. Cato counts five administrator arrests across three operations.
Each time, the brand re-emerged within days or weeks. Cato describes this resilience as organisational rather than technical: ShinyHunters has become a reusable identity that survives arrests, platform losses and operator turnover. By 2025 that identity had expanded into the Scattered LAPSUS$ Hunters (SLH) federation, combining the ShinyHunters name, Scattered Spider's social engineering and the aggressive tactics of LAPSUS$.
What defenders need to fix first
Cato's recommendations focus on the conditions that let these tactics work rather than on the group itself:
- Enforce phishing-resistant MFA for privileged SaaS roles.
- Audit and allow-list OAuth-connected apps across Salesforce, Google Workspace and Microsoft 365.
- Alert in real time on every new third-party authorisation.
- Run help-desk vishing simulations based on the documented "connectivity troubleshooting" scenario.
- Restrict sensitive API access by IP address and monitor bulk export behaviour.
- Treat dark web listings and SLH-linked extortion activity as incident triggers, not PR problems.
Key points
- Cato CTRL published its ShinyHunters threat actor profile on 18 June 2026.
- In UNC6040, a vishing call led an employee to approve a malicious Salesforce connected app, giving the attacker an OAuth token without any password or MFA compromise.
- The related UNC6395 cluster used stolen OAuth tokens from trusted integrations such as Salesloft Drift.
- The brand has outlasted the RaidForums seizure, two BreachForums seizures, five administrator arrests and the sentencing of its founder.
- Cato advises OAuth app allow-listing, real-time alerts on new authorisations and help-desk vishing drills alongside phishing-resistant MFA.