ShinyHunters Vishing: 40 Million Records Stolen From Charter and 400 Organizations

The ShinyHunters vishing SaaS extortion attack executes in five distinct phases, each engineered to bypass a specific layer of enterprise security before the next phase begins.

Phase 1: Reconnaissance and target selection. ShinyHunters operators identify targets using LinkedIn data to map employees in IT support, helpdesk, and identity management roles. They build victim-branded phishing portals that replicate the target organization's internal SSO login page, registering domains following predictable patterns: <companyname>sso[.]com, <companyname>okta[.]com, <companyname>internal[.]com, support-<companyname>[.]com. UNC6661 registers infrastructure on NICENIC; UNC6671 uses Tucows. Domain registrations appear within hours of selecting a new target.

Phase 2: Vishing the employee. Attackers call a targeted employee, impersonating IT staff and claiming the company is updating MFA settings or responding to an account anomaly. Using specialized real-time phishing kits, they direct the victim to the spoofed SSO portal while maintaining verbal contact throughout the session. The kits capture SSO credentials, MFA one-time codes, and push notification approvals as the victim enters them. For Okta environments, the attacker registers their own MFA device to the victim's account before the call ends.

Phase 3: Deleting the evidence. Immediately after gaining access, attackers authorize ToogleBox Recall, a third-party Google Workspace add-on, to delete all "Security method enrolled" and "New MFA device registered" notification emails from the victim's inbox. In Microsoft 365 environments, Exchange rules auto-delete authentication alerts. The victim never sees the notification confirming the attacker's device registration.

Phase 4: SaaS pivoting and data exfiltration. With a valid, persistent SSO session, attackers move through the victim's SaaS ecosystem. Confirmed exfiltration targets include Salesforce, SharePoint, OneDrive, Slack, Google Workspace, DocuSign, and Anodot. At Charter Communications, attackers used the compromised Entra session to export 40 million records directly from Salesforce. At Canvas, previously stolen Anodot authentication tokens were reused to access 275 million education records across 330 institutions.

Phase 5: Extortion. Ransom emails specify the stolen data volume, a Bitcoin payment address, and a 72-hour payment deadline. Victims who do not respond face DDoS attacks, direct harassment of personnel via SMS messages, and public posting of stolen data samples to the ShinyHunters-branded data leak site that launched in January 2026. Where victims still do not pay, full datasets are auctioned on criminal forums.

ShinyHunters' 2026 campaign is the group's largest coordinated operation in its seven-year history. Over 400 organizations across 13 sectors have been compromised, with new confirmed victims appearing weekly throughout April and May 2026.

The confirmed 2026 victim list includes Charter Communications (40 million records, disclosed May 26), Canvas/Instructure (275 million education records across 330 institutions, May 7), 7-Eleven (185,000 customers), ADT via Salesforce, Harvard, Princeton, Wynn Resorts, Betterment, Crunchbase, and SoundCloud. SecurityWeek confirmed unauthorized access at Atlassian, Canva, Epic Games, HubSpot, Moderna, WeWork, and ZoomInfo as part of the broader campaign.

Google's Mandiant GTIG tracks three distinct operational clusters. UNC6661 uses NICENIC-registered infrastructure and Tox for ransom negotiations, hosting proof samples on Limewire. UNC6671 runs parallel vishing operations with Tucows-registered domains, different Tox identifiers, and aggressive harassment tactics including threatening employees directly. UNC6240 handles post-intrusion extortion and maintains the ShinyHunters-branded data leak site. Silent Push attributes the combined campaign to "Scattered LAPSUS$ Hunters," an operational merger drawing members from Lapsus$, Scattered Spider, and the original ShinyHunters group.

This is not targeted spear-phishing at a handful of high-value organizations. The group runs parallel campaigns against dozens of companies simultaneously. Any enterprise using Okta, Microsoft Entra, or Google Workspace SSO with push-based or SMS MFA is within the active targeting profile.

The 2024 Snowflake campaign, which yielded the Ticketmaster breach affecting 560 million records and AT&T's full call logs, established that ShinyHunters-linked operators chain stolen credentials across the SaaS ecosystem at scale. The TanStack supply chain attack that exposed developer credentials on the dark web demonstrates how downstream credential markets from breaches like these feed the next wave of vishing reconnaissance.

Mandiant and Google GTIG's analysis of the ShinyHunters vishing SaaS extortion campaign maps to nine MITRE ATT&CK techniques, all of which execute without exploiting a single software vulnerability.

T1598.004, Spearphishing Voice (Vishing): Attackers call employees using spoofed caller IDs, impersonating IT support. Calls target helpdesk staff, new employees less familiar with security protocols, and employees listed in IT or identity management roles on LinkedIn. Real-time phishing kits allow the attacker to control the entire authentication flow while maintaining verbal contact with the victim.

T1539, Steal Web Session Cookie: The phishing kits capture Okta session tokens, Microsoft Entra refresh tokens, and Google Workspace session cookies as victims authenticate on spoofed portals. These tokens are imported directly into attacker-controlled browsers, bypassing MFA verification entirely.

T1556.006, Modify Authentication Process: Multi-Factor Authentication: Operators register attacker-controlled MFA devices to victim accounts during the vishing call itself, establishing persistent access that survives password resets. This single action converts a temporary phishing session into a long-term persistent foothold.

T1078, Valid Accounts: All post-initial-access activity uses the victim's own authenticated session. Detection tools relying on credential anomalies struggle when attackers use legitimate tokens routed through VPN services including Mullvad, Oxylabs, 9Proxy, NetNut, Infatica, and nsocks to blend into enterprise security tooling.

T1530, Data from Cloud Storage Object: Attackers conduct bulk downloads from SharePoint, OneDrive, Google Workspace, and Salesforce, searching for documents containing terms including "poc," "confidential," "internal," "proposal," "vpn," and PII fields. Charter's Salesforce export and Canvas's Anodot-linked record theft both followed this pattern precisely.

T1562 / T1114.003, Impair Defenses and Email Collection: ToogleBox Recall (Google Workspace) and Exchange inbox rules delete all MFA enrollment and security alert notifications, preventing the legitimate account holder from detecting the intrusion for days or weeks.

The Gentlemen ransomware active campaign demonstrated criminal groups achieving nation-state intrusion quality through structured affiliate networks. ShinyHunters demonstrates the parallel threat: technically simple initial access paired with systematic evidence destruction delivering enterprise-scale data theft without touching a single CVE.

The following indicators are confirmed by Mandiant GTIG, Huntress, and forensic analysis of active ShinyHunters intrusions. Ingest all IP addresses into SIEM, EDR, and perimeter controls immediately.

Confirmed UNC6661 and UNC6671 infrastructure IPs:

• 24.242.93[.]122 (ASN 11427), UNC6661 operational infrastructure
• 149.50.97[.]144 (ASN 201814), UNC6661 operational infrastructure
• 142.127.171[.]133 (ASN 577), UNC6671 operational infrastructure
• 23.234.100[.]107, UNC6661/UNC6240 associated extortion infrastructure

VPN and proxy ASNs used to blend access with legitimate traffic: Alert on Okta or Entra sign-ins from Mullvad VPN, Oxylabs residential proxy, 9Proxy, NetNut, Infatica, or nsocks ASN ranges. The Mandiant GTIG detection query specifically targets these as anonymized IP indicators in Okta logs. Blocking or requiring step-up authentication for these ASN ranges closes the post-initial-access camouflage layer.

Domain registration pattern monitoring: Any domain registered in the last 30 days matching <yourbrand>sso.com, <yourbrand>okta.com, <yourbrand>internal.com, support-<yourbrand>.com, or <yourbrand>access.com indicates an in-progress or planned ShinyHunters campaign targeting your organization. Configure Google Workspace and Microsoft 365 alerts for first-use events from these domain patterns.

ToogleBox Recall OAuth authorization event: A Google Workspace OAuth authorization event for "ToogleBox Recall" in any account is a confirmed intrusion indicator. This add-on has no legitimate enterprise use case and its presence confirms ShinyHunters or copycat TTPs in the environment.

ShinyHunters does not restrict its targeting to specific industries, but the 2026 campaign data reveals clear patterns in sector exposure based on SaaS stack architecture and SSO configuration maturity.

Telecommunications is the current highest-profile target following the Charter Communications breach confirming 40 million records stolen. Telecom organizations hold CPNI data, customer financial records, and network infrastructure access credentials, making the extortion value extremely high per victim. Any carrier or managed service provider running Salesforce with Okta or Entra SSO and push-based MFA carries the same attack surface Charter exposed.

Education technology has suffered the most volume-intensive breach. The Canvas/Instructure compromise across 330 institutions exposed 275 million student and faculty records. Educational institutions typically have broader user populations, less mature security operations, and more users susceptible to helpdesk-impersonation vishing, particularly student workers in IT roles.

Software and technology firms face elevated risk because a single compromised Okta tenant can provide access to dozens of downstream SaaS integrations via OAuth. Confirmed 2026 targets include Atlassian, Canva, HubSpot, and ZoomInfo. A breach at a SaaS vendor creates cascading exposure for every customer with active OAuth app integrations.

Healthcare and pharmaceutical organizations face double exposure: HIPAA-regulated patient data and high-value research data. Confirmed 2026 targets include Moderna and multiple healthcare institutions in the Okta vishing campaign.

Financial services firms including Betterment face account takeover risk that extends beyond data theft into direct financial fraud via compromised advisor and client account access.

Any organization running Okta, Microsoft Entra, or Google Workspace with push-based or SMS MFA and active Salesforce integration should treat this campaign as a present, ongoing threat today regardless of sector.

Organizations using Okta, Microsoft Entra, or Google Workspace SSO must complete the following steps before end of business today. ShinyHunters' current campaign rate means new organizations are being confirmed as breached every 24 to 48 hours.

The Charter Communications confirmation on May 26, 2026 marks the most significant ShinyHunters disclosure of the year, but the breach happened 56 days before it became public. In those 56 days, 40 million customers were exposed with no opportunity to change passwords, monitor accounts, or take protective action. That 56-day gap is not a Charter Communications failure specific to their organization. It is the standard detection timeline when attackers use valid credentials, delete enrollment notifications, and operate entirely within authorized SaaS sessions.

ShinyHunters vishing SaaS extortion attacks expose a structural vulnerability in how enterprises built their security architectures. Organizations have layered on SaaS tools, SSO platforms, and cloud storage without proportionally hardening the human access layer. FIDO2 phishing-resistant authentication solves the exact technical failure ShinyHunters exploits. The technology exists. It is widely available and supported by Okta, Microsoft, and Google natively. And it is the one control that would have prevented every confirmed 2026 ShinyHunters breach.

Three facts define the immediate risk level. First, the group is confirming new breaches multiple times per week with no signs of deceleration through May 2026. Second, exfiltration happens within hours of initial access, meaning detection after the vishing call ends is typically too late to prevent data theft. Third, the 72-hour extortion clock means organizations that detect a breach after the fact face an immediate ransom decision rather than a standard incident response timeline.

The window for non-emergency action is today. Enforce FIDO2 for all privileged and IT accounts by end of week. Disable self-service MFA device enrollment today. Audit third-party OAuth app authorizations today. Organizations that complete these three controls eliminate the specific attack surface ShinyHunters exploits in every confirmed 2026 intrusion.