ShinyHunters Vishing Campaign Targets Okta SSO and SaaS Platforms

• •ShinyHunters employs voice phishing to steal SSO credentials and bypass MFA.
• •Attackers impersonate IT staff and use real-time phishing kits for credential harvesting.
• •The campaign targets SaaS platforms, particularly in the healthcare sector, with a focus on extortion.

A voice phishing campaign attributed to the ShinyHunters group is actively targeting organizations using Okta SSO and other SaaS platforms. The attackers impersonate IT staff to convince employees to provide their SSO credentials and MFA codes through counterfeit login portals. Once the attackers gain access, they can register their devices, bypass MFA protections, and exfiltrate sensitive data for extortion. This campaign does not exploit software vulnerabilities but relies on advanced social engineering techniques. Mandiant has linked this activity to multiple clusters, including UNC6661 and UNC6671, and noted that it has been ongoing since early January 2026. The healthcare sector has been particularly affected, with reports of aggressive tactics and impersonation of medical staff. Organizations are advised to enhance their MFA methods and conduct regular training to mitigate risks. The campaign represents a significant shift in threat vectors, emphasizing the need for phishing-resistant authentication methods.