ShinyHunters claim hacks of Okta, Microsoft SSO accounts for data theft

The ShinyHunters extortion group has claimed responsibility for a series of sophisticated voice phishing (vishing) attacks targeting Single Sign-On (SSO) accounts across major platforms like Okta, Microsoft Entra, and Google. These attacks involve threat actors impersonating IT support to trick employees into providing credentials and Multi-Factor Authentication (MFA) codes on malicious phishing sites, enabling real-time MFA bypass.

Once an SSO account is compromised, attackers gain broad access to connected enterprise applications and services, facilitating data exfiltration and subsequent extortion demands. Security teams and detection engineers must prioritize robust defenses against social engineering, enhance MFA security, and implement continuous monitoring for suspicious SSO activity and access patterns to mitigate the risk posed by these advanced phishing techniques.