{
  "name": "Threat Spotlight: ShinyHunters Fast-Tracks SaaS Access with Subdomain Impersonation",
  "slug": "threat-spotlight-shinyhunters-fast-tracks-saas-access-with-subdomain-impersonation",
  "description": "The threat group ShinyHunters has adopted a new tactic of subdomain impersonation for initial access, moving away from newly registered lookalike domains. They are utilizing mobile-first lures and outsourcing spam services to scale their operations. The group is likely reusing previously stolen CRM and ERP data to drive social engineering attacks. Their approach involves phone-guided adversary-in-the-middle phishing to capture credentials and authenticated sessions. ShinyHunters is also scaling vishing operations through paid contractors and specialized harassment services. This evolution in tactics allows for rapid identity-to-SaaS compromise without deploying malware, making traditional domain-based monitoring less effective.",
  "published": "2026-03-19T13:23:02+00:00",
  "created_at": "2026-03-19T13:23:02+00:00",
  "modified_at": "2026-03-20T07:17:58+00:00",
  "created_at_opencti": "2026-03-19T13:23:02+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-03-19",
    "aitm phishing",
    "crm data abuse",
    "identity theft",
    "mobile-first lures",
    "saas compromise",
    "session hijacking",
    "subdomain impersonation",
    "vishing"
  ],
  "related_entities": {
    "intrusion_sets": [
      {
        "id": "079059d2-e9f0-4301-bcf3-6e0b6bf4e197",
        "name": "ShinyHunters",
        "slug": "shinyhunters"
      }
    ],
    "attack_patterns": [
      {
        "id": "75702b35-b790-4504-a1e0-7829e76f22e9",
        "name": "T1585"
      },
      {
        "id": "6babd5aa-5112-4f14-a660-60d756a65d6d",
        "name": "T1586"
      },
      {
        "id": "5e3b3612-8bf8-46e1-943e-b4c1524bef11",
        "name": "T1587"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "5fbd38af-69a3-49b9-9ff4-e7ab3e59bd12",
        "name": "T1534"
      },
      {
        "id": "5c67e5d2-bc85-4ce0-822d-f2f5d3b0ae4e",
        "name": "T1185"
      },
      {
        "id": "c340d47a-2ea8-41ca-9a0b-a72559b89bbf",
        "name": "T1584"
      },
      {
        "id": "7e3e3784-9547-42ca-b888-482972d14be3",
        "name": "T1528"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "2969e5a7-1049-4df8-b1ba-8a0675de6b94",
        "name": "T1589"
      },
      {
        "id": "29f7ff93-033b-4f8d-8691-5bcaa438c80f",
        "name": "T1592"
      },
      {
        "id": "74d5f31c-5e2d-4aed-b8b9-4fabdde76dfa",
        "name": "T1598"
      },
      {
        "id": "5dee2969-7083-430e-9083-73bab54c3a18",
        "name": "T1590"
      },
      {
        "id": "9c5a20d1-0df9-4e99-bcc5-0b731a78b5d1",
        "name": "T1608"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "Pharmacy and drugs manufacturing"
      },
      {
        "id": "",
        "name": "Health"
      },
      {
        "id": "",
        "name": "help-okta.com"
      },
      {
        "id": "",
        "name": "setup-okta.com"
      },
      {
        "id": "",
        "name": "okta.guide"
      },
      {
        "id": "",
        "name": "prod-okta.com"
      },
      {
        "id": "",
        "name": "lock-okta.com"
      },
      {
        "id": "",
        "name": "desk-okta.com"
      },
      {
        "id": "",
        "name": "acess-terms.com"
      },
      {
        "id": "",
        "name": "access-terms.com"
      },
      {
        "id": "",
        "name": "safe-okta.com"
      },
      {
        "id": "",
        "name": "okta.domains"
      },
      {
        "id": "",
        "name": "sso-verify.com"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/69bc06c6867cdad6f8a94d99",
    "https://reliaquest.com/blog/threat-spotlight-shinyhunters-fast-tracks-saas-access-subdomain-impersonation/"
  ]
}