[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjcYnDpe-HQSvPgcCCV8uB8fJ6-WEczaME8J9pACjpqk":3,"$f-IyDNywaOs4DPwBm6LJSKxKxyPHANmZyYxA0mk3sKwM":78},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":75,"created_at":76,"updated_at":77,"published_at":35},"shinyhunters-bypasses-mfa-with-salesforce-oauth-playbook","Cato CTRL Profiles ShinyHunters: Help-Desk Vishing and Trusted OAuth Apps Sidestep MFA","Cato's June 2026 threat actor profile says the brand has outlasted three forum seizures and its founder's conviction, and that its Salesforce campaigns need no password or MFA compromise.","Cato CTRL's threat actor profile of ShinyHunters, published on 18 June 2026, describes how the UNC6040 campaign talked employees into approving a malicious Salesforce connected app and how the related UNC6395 cluster used stolen Salesloft Drift OAuth tokens, gaining access without compromising passwords or MFA.",[10,11,12,13,14,15],"ShinyHunters","Salesforce","MFA bypass","OAuth","Cato Networks","UNC6040","# Cato CTRL Profiles ShinyHunters: Help-Desk Vishing and Trusted OAuth Apps Sidestep MFA\n\n*Cato's June 2026 threat actor profile says the brand has outlasted three forum seizures and its founder's conviction, and that its Salesforce campaigns need no password or MFA compromise.*\n\n**Tags:** `ShinyHunters` `Salesforce` `OAuth` `Vishing` `Cato CTRL` `UNC6040` `UNC6395`\n\n> Cato CTRL's threat actor profile of ShinyHunters, published on 18 June 2026, describes how the UNC6040 campaign talked employees into approving a malicious Salesforce connected app and how the related UNC6395 cluster used stolen Salesloft Drift OAuth tokens, gaining access without compromising passwords or MFA.\n\n---\n\n## The playbook that walks past MFA\n\nOn 18 June 2026 Cato Networks' threat research team, Cato CTRL, published a threat actor profile of ShinyHunters. Its central point is that the group's 2025 to 2026 operations rely on trusted identity flows and business logic rather than exploit chains or basic phishing.\n\nIn the UNC6040 campaign, according to Cato the attacker called the help desk, impersonated internal IT and guided an employee through a \"connectivity troubleshooting\" process. That process ended with the employee approving a malicious Salesforce connected app. Once the app was approved, the attacker held an OAuth token carrying the user's permissions. Cato notes that this required no password spraying, no exploit chain and no compromise of MFA: the user's own approval did the work.\n\nA related cluster, UNC6395, removed the social engineering step altogether. It used stolen OAuth tokens tied to trusted integrations such as Salesloft Drift, which gave access without malware, login prompts or suspicious endpoint artefacts.\n\nCato's conclusion is that strengthening user MFA alone is not enough, because the weakness sits in connected applications rather than in the login.\n\n## Who is ShinyHunters in 2026\n\nShinyHunters made its name in 2020 as a high-volume broker of stolen databases. Since then, according to Cato, the ecosystem around it has been hit repeatedly: RaidForums was seized, BreachForums was seized twice, the group's founder was extradited and sentenced, and several high-profile administrators were arrested in France in 2025. Cato counts five administrator arrests across three operations.\n\nEach time, the brand re-emerged within days or weeks. Cato describes this resilience as organisational rather than technical: ShinyHunters has become a reusable identity that survives arrests, platform losses and operator turnover. By 2025 that identity had expanded into the Scattered LAPSUS$ Hunters (SLH) federation, combining the ShinyHunters name, Scattered Spider's social engineering and the aggressive tactics of LAPSUS$.\n\n## What defenders need to fix first\n\nCato's recommendations focus on the conditions that let these tactics work rather than on the group itself:\n\n- Enforce phishing-resistant MFA for privileged SaaS roles.\n- Audit and allow-list OAuth-connected apps across Salesforce, Google Workspace and Microsoft 365.\n- Alert in real time on every new third-party authorisation.\n- Run help-desk vishing simulations based on the documented \"connectivity troubleshooting\" scenario.\n- Restrict sensitive API access by IP address and monitor bulk export behaviour.\n- Treat dark web listings and SLH-linked extortion activity as incident triggers, not PR problems.\n\n## Key points\n\n- Cato CTRL published its ShinyHunters threat actor profile on 18 June 2026.\n- In UNC6040, a vishing call led an employee to approve a malicious Salesforce connected app, giving the attacker an OAuth token without any password or MFA compromise.\n- The related UNC6395 cluster used stolen OAuth tokens from trusted integrations such as Salesloft Drift.\n- The brand has outlasted the RaidForums seizure, two BreachForums seizures, five administrator arrests and the sentencing of its founder.\n- Cato advises OAuth app allow-listing, real-time alerts on new authorisations and help-desk vishing drills alongside phishing-resistant MFA.\n\n## Further reading & sources\n\n- [Cato CTRL Threat Actor Profile: ShinyHunters – The Brand That Outlasts the Takedowns](https:\u002F\u002Fwww.catonetworks.com\u002Fblog\u002Fcato-ctrl-shinyhunters-the-brand-that-outlasts-the-takedowns) (Cato Networks)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fshinyhunters-bypasses-mfa-with-salesforce-oauth-playbook.png?v=cacb0fd7ee",{"iocs":19,"actors":23,"targets":47,"timeline":54,"industries":59,"technologies":70},[20],{"type":21,"value":22},"other","Scattered Lapsus$ Hunters",[24,31,37,41],{"url":25,"name":26,"slug":27,"type":28,"origin":29,"motivation":30},"\u002Fthreat-groups\u002Flapsus","LAPSUS$","lapsus","ransomware","United Kingdom and Brazil","financial",{"url":32,"name":22,"slug":33,"type":34,"origin":35,"motivation":36},"\u002Fthreat-groups\u002Fscattered-lapsus-hunters","scattered-lapsus-hunters","unknown",null,"extortion",{"url":38,"name":39,"slug":39,"type":28,"origin":40,"motivation":35},"\u002Fthreat-groups\u002Fshinyhunters","shinyhunters","Russia",{"url":42,"name":43,"slug":44,"type":45,"origin":46,"motivation":30},"\u002Fthreat-groups\u002Fscattered-spider","Scattered Spider","scattered-spider","cybercrime","United States and United Kingdom (native English-speaking members)",[48,51],{"name":11,"sector":49,"status":50,"geography":35},"Technology","confirmed",{"name":52,"sector":53,"status":50,"geography":35},"Jaguar Land Rover","Automotive",[55],{"date":56,"event":57,"description":58},"2026-01","Breach","Panera ShinyHunters breach",[60,63,66],{"url":61,"name":49,"slug":62},"\u002Findustries\u002Ftechnology","technology",{"url":64,"name":53,"slug":65},"\u002Findustries\u002Fautomotive","automotive",{"url":67,"name":68,"slug":69},"\u002Findustries\u002Fsoftware-saas","Software & SaaS","software-saas",[71,72],{"vendor":11,"product":11},{"vendor":73,"product":74},"Salesloft","Drift","threat_actor_activity","2026-09-05T07:16:15.004025+00:00","2026-10-16T12:28:53.238955+00:00",{"articles":79},[80,92,105,118],{"slug":81,"title":82,"summary":83,"tags":84,"hero_image_url":89,"story_type":90,"created_at":91},"trezor-confirms-data-breach-at-shipmonk-affecting-14-000-customers","Trezor Confirms Customer Data Exposed in ShipMonk Breach, Total Now Over 80,000","Trezor says its shipping provider ShipMonk suffered a breach that exposed about 13,700 recent customers, and in September 2026 added roughly 67,000 more US customers from older orders; ShipMonk attributed the intrusion to a vulnerability in Metabase, and the ShinyHunters extortion group has claimed an attack on Metabase.",[85,10,86,87,88],"Data Breach","Trezor","ShipMonk","Metabase","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrezor-confirms-data-breach-at-shipmonk-affecting-14-000-customers.png?v=f8ae5b52ce","breach","2026-08-18T17:57:49.084977+00:00",{"slug":93,"title":94,"summary":95,"tags":96,"hero_image_url":103,"story_type":75,"created_at":104},"star-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t","Star Blizzard swaps ClickFix for RedFlick to deliver its CosmicPulse backdoor","Microsoft reports that Star Blizzard, a Russian state actor that CISA attributes to FSB Centre 18, has replaced its multi-step ClickFix chains with RedFlick, a delivery technique that needs a single user interaction and uses scheduled tasks to deploy the CosmicPulse backdoor. At least 13 campaigns since January 2026 affected more than 100 organisations, primarily in the United States and United Kingdom.",[97,98,99,100,101,102],"Star Blizzard","RedFlick","CosmicPulse","ClickFix","Ukraine","FSB","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstar-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t.png?v=5367408196","2026-10-18T12:09:44.53734+00:00",{"slug":106,"title":107,"summary":108,"tags":109,"hero_image_url":116,"story_type":75,"created_at":117},"kaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz","Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure","Kaspersky has described a previously unknown APT group, Armored Likho, running a spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer against government agencies and the electric power sector in Russia, Brazil and Kazakhstan.",[110,111,112,113,114,115],"Armored Likho","BusySnake Stealer","Kaspersky","APT","spear-phishing","critical infrastructure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz.png?v=1bc6e1f6d4","2026-09-19T12:06:09.947355+00:00",{"slug":119,"title":120,"summary":121,"tags":122,"hero_image_url":129,"story_type":75,"created_at":130},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC, with Korea's National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, published 'Operation Double Barrel' on 30 July 2026, describing a state-sponsored actor that has exploited Korean financial security software since 2025 and the overlaps it shares with Gunra ransomware intrusions.",[123,124,125,126,127,128],"Gunra","AhnLab ASEC","Operation Double Barrel","FortiOS","FortiProxy","Ransomware","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","2026-09-18T07:15:06.272711+00:00"]