ShinyHunters PeopleSoft Post-Exploitation System Enumeration

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•9

Detects post-exploitation system discovery and reconnaissance commands performed by PeopleSoft service accounts (psoft, oracle, linuxadm) on Linux hosts. This activity aligns with observed techniques from the ShinyHunters CVE-2026-35273 campaign, where compromised service accounts were used to map the local environment.