EdgeProtect
Threat News
Latest cyber threat intelligence, breaches and exploitation
2 matching stories
ShinyHuntersCato CTRL Profiles ShinyHunters: Help-Desk Vishing and Trusted OAuth Apps Sidestep MFA
Cato CTRL's threat actor profile of ShinyHunters, published on 18 June 2026, describes how the UNC6040 campaign talked employees into approving a malicious Salesforce connected app and how the related UNC6395 cluster used stolen Salesloft Drift OAuth tokens, gaining access without compromising passwords or MFA.
Trezor Confirms Customer Data Exposed in ShipMonk Breach, Total Now Over 80,000
Trezor says its shipping provider ShipMonk suffered a breach that exposed about 13,700 recent customers, and in September 2026 added roughly 67,000 more US customers from older orders; ShipMonk attributed the intrusion to a vulnerability in Metabase, and the ShinyHunters extortion group has claimed an attack on Metabase.
