Unmasking ShinyHunters

Between January 26 and April 16, 2026, Mjolnir Threat Analytics Center (MTAC) proprietary sensor telemetry recorded 650 discrete events attributable to the ShinyHunters data extortion ecosystem. This campaign encompassed active extortion servers hosting stolen databases, a sprawling phishing infrastructure of credential-harvesting domains, 429 0ktapus adversary-in-the-middle (AitM) MFA-bypass events, and at least 9 named corporate victims whose data appeared on pay-or-leak extortion portals. This report provides a comprehensive deep dive into ShinyHunters' evolution from a data broker collective into a full-spectrum extortion empire, mapping the group's infrastructure, tactics, tooling, and connections to Scattered Spider and Lapsus$.

Campaign Statistics

The following statistics summarize MTAC sensor telemetry from the ShinyHunters campaign observation window (January 26 – April 16, 2026).

Event Category Breakdown

Monthly Event Breakdown

Who Are ShinyHunters?

ShinyHunters — named after the Pokemon practice of hunting for rare "shiny" variants — emerged in 2020 as a loosely organized collective of data brokers specializing in breaching cloud databases and selling stolen records on dark web forums. Over five years, the group has undergone a dramatic evolution from opportunistic data theft into a full-spectrum extortion empire that combines SSO phishing, AitM MFA bypass, cloud exploitation, and direct victim extortion.

Evolution Timeline

Operator Profiles and Arrests

In January 2024, French national Sebastien Raoult (alias "Sezyo Kaizen") was sentenced to 3 years in US federal prison and ordered to pay $5 million in restitution for his role in ShinyHunters operations. Raoult was extradited from Morocco to the United States after being identified through operational security failures in ShinyHunters' early campaigns. His arrest demonstrated that Western law enforcement can reach into the group's operational structure — but did nothing to slow the collective's activities, which accelerated through 2024 and into 2026.

The group maintains significant personnel overlap with both Scattered Spider (UNC3944) and Lapsus$. As cybercrime researcher Brian Krebs has documented, these groups share operators, tooling, and targeting patterns. The convergence is not coincidental — it represents a new model of cybercriminal organization where fluid, loosely affiliated operators move between branded operations based on opportunity and capability. Our earlier analysis in Convergence of Chaos explored this interconnected ecosystem in detail.

The “Scattered Lapsus Hunters” (SLH) Merger

The 2026 threat landscape is dominated by what MTAC has designated the SLH Triad. This is not a loose collaboration but a federated alliance of three specialized operations, each contributing distinct expertise to a unified extortion engine:

The “Identity-First” Attack Chain

The SLH Triad has abandoned traditional malware. MTAC assesses that 90% of observed intrusions follow this identity-based path:

1. Reconnaissance: Scraping LinkedIn for IT Help Desk names and employee lists
2. Vishing: A Scattered Spider operator calls an employee, claiming to be from IT, using a social engineering script to “verify” MFA settings
3. AitM Phishing: The victim is sent to a branded 0ktapus 2.0 site (e.g., company-okta[.]com) that intercepts the MFA token in real time
4. Device Enrollment: The attacker registers a Genymobile-emulated Android device (often named “Passkey”) as a new MFA factor to ensure persistence

The Extortion Machine: pay_or_leak

MTAC sensors recorded 44 events associated with two dedicated extortion servers hosting stolen databases with a distinctive taunting filename convention. The infrastructure is deliberately minimalist — no Tor hidden services, no elaborate leak sites. Instead, the operators use direct-access servers with victim-specific filenames designed to maximize psychological pressure on targets.

Extortion Infrastructure

Files are hosted with a deliberate naming convention: [victim]_pay_or_leak_[date].7z or [victim]_[MM]_[YYYY].sql.7z. This is not mere file organization — it is a psychological tactic. The filenames are designed to be discovered by security researchers, indexed by threat intelligence platforms, and ultimately communicated back to the victim, amplifying pressure to pay.

Named Extortion Victims

The Salesforce “Aura” Automation

In a significant escalation of capability, ShinyHunters has repurposed the AuraInspector tool to automate exploitation of misconfigured Salesforce Experience Cloud sites. The tool scans for /s/sfsites/aura endpoints and exploits guest user profile misconfigurations to exfiltrate CRM data at scale. Even after Salesforce patched the sortBy bypass that allowed bulk data export, the group claims to have developed a “configuration-agnostic” method to query guest user profiles, bypassing the 2,000-record limit entirely. MTAC assesses that over 400 organizations may have been affected.

The Phishing Arsenal

ShinyHunters operates an extensive network of SSO credential-harvesting domains designed to impersonate enterprise login portals. These domains are registered with high visual fidelity to legitimate SSO pages and are typically deployed for 72-96 hours before rotation. MTAC identified the following active phishing domains during the observation window.

SSO Credential Harvesting Domains

Additionally, MTAC identified an Okta phishing campaign targeting Goldin Auctions, a high-value collectibles auction house. The campaign used a cloned Okta SSO page to harvest credentials from Goldin employees and consignors, likely targeting access to auction management systems and high-net-worth customer data.

The 0ktapus Kit

The 0ktapus phishing kit is the single most significant tool in ShinyHunters' arsenal, accounting for 429 of 650 events (66%) observed during the campaign window. Unlike traditional credential phishing, 0ktapus operates as a real-time adversary-in-the-middle (AitM) proxy that intercepts both credentials and MFA tokens simultaneously, rendering time-based one-time passwords (TOTP) and push notification MFA completely ineffective.

How 0ktapus Defeats MFA

The kit sits between the victim and the legitimate authentication server, transparently proxying the login flow. When the victim enters their username, password, and MFA token, the kit captures all three values and replays them to the real server in real time. The authenticated session cookie is then intercepted and passed back to the attacker, who gains full access to the victim's account. The entire process takes under 2 seconds and is invisible to the victim.

0ktapus 2.0 Forensic Markers

MTAC has identified specific forensic artifacts left by the 0ktapus 2.0 kit during the MFA bypass phase that defenders should hunt for immediately:

Recruitment Scam Domains

ShinyHunters also operates a network of fake recruitment and career domains used for social engineering initial access. These domains lure victims with fake job offers, directing them to credential-harvesting pages or malware downloads.

Canadian Targeting — Supply Chain Escalation

MTAC observed a notable concentration of activity targeting Canadian telecommunications and retail companies. The campaign against Canada has shifted from simple data theft to supply chain extortion — the breach of Telus and Rogers appears linked to the compromise of Anodot, a third-party analytics provider. ShinyHunters stole Anodot service account tokens to silently export PII without triggering standard login alerts.

Lapsus$ Infrastructure

MTAC sensors detected 16 events associated with active Lapsus$-branded domains that share operational infrastructure with the ShinyHunters ecosystem. While Lapsus$ was widely believed to have been disrupted by arrests in 2022-2023, the presence of active infrastructure suggests that the brand and tooling remain in operational use within the broader data extortion ecosystem.

The infrastructure overlap between Lapsus$ and ShinyHunters domains — including shared hosting providers, registration patterns, and SSL certificate configurations — confirms the operational convergence documented in our Convergence of Chaos analysis. These are not separate groups maintaining independent operations; they are overlapping operators sharing a common infrastructure ecosystem. For a full Lapsus$ profile, see our Lapsus$ threat profile.

MITRE ATT&CK Mapping

Indicators of Compromise

The following indicators were observed through MTAC sensor telemetry between January 26 and April 16, 2026. All domains are defanged. Organizations should implement blocking at DNS, proxy, and email gateway layers.

Extortion Server IPs

Primary Phishing Domains

Recruitment Scam Domains

Additional Phishing & C2 Infrastructure

ShinyHunters Own Infrastructure

Lapsus$ Domains

Extortion Server URLs

Recommendations

Immediate Actions (0-48 Hours)

• Block all IOCs at DNS, proxy, email gateway, and firewall layers. Ingest the full IOC list into your SIEM and EDR platforms for retroactive hunting.
• Implement pattern-based domain blocking using the naming conventions documented above. ShinyHunters rotates domains every 72-96 hours; static blocklists alone are insufficient.
• Audit SSO authentication logs for the past 90 days. Look for login attempts from the phishing domains listed above, unusual geographic locations, or anomalous session token patterns.
• Review extortion server connectivity. Check network logs for any outbound connections to 37.72.140[.]17 or 91.215.85[.]22. Any hits indicate potential data exfiltration or reconnaissance.
• Salesforce Audit: Immediately run AuraInspector (or equivalent) against all public Salesforce Experience Cloud sites. Disable API access for the “Guest User Profile” unless explicitly required. Scan for /s/sfsites/aura endpoint exposure.
• MFA Hardening: Transition from “Push” to “Number Matching” immediately as a stop-gap. Prioritize FIDO2/WebAuthn (YubiKey/Titan) to fully defeat 0ktapus 2.0 AitM attacks.
• Hunt for 0ktapus 2.0 forensic markers: Search for com.okta.android.auth user-agent strings, MFA device enrollments named “Passkey” on Genymobile platforms, and accounts that left Security/IR Slack channels immediately after login.

Short-Term Actions (1-4 Weeks)

• Deploy FIDO2/WebAuthn hardware security keys for all privileged accounts, cloud administrators, and executives. This is the only MFA method resistant to 0ktapus AitM attacks. TOTP and push-based MFA must not be considered sufficient for high-value accounts.
• Implement Continuous Access Evaluation (CAE). If a user’s IP changes to a known VPN or a new MFA device is enrolled, automatically revoke all active SaaS sessions (O365, Salesforce, Slack).
• Build 0ktapus 2.0 detection rules. Monitor for anomalous authentication patterns: legitimate MFA tokens used from unexpected IPs within seconds of being generated, Genymobile device enrollments, or session cookies appearing from different ASNs than the authentication request.
• Implement brand monitoring for your organization’s name in newly registered domains. Services like DomainTools, SecurityTrails, or MTAC can alert on lookalike domain registrations within hours.
• Anti-Vishing Help Desk Protocol:
  • Video Verification: All password/MFA resets must be conducted via a live video call. The employee must hold a physical government ID to the camera.
  • Out-of-Band Callbacks: If a user calls for a reset, the help desk must terminate the call and call the employee back on their registered corporate phone number.

Strategic Actions (1-3 Months)

• Develop a data extortion response plan. Unlike ransomware, data extortion does not offer a decryption key as leverage. Response plans must address legal, regulatory, communications, and negotiation dimensions. Have the plan ready before the demand arrives.
• Deploy cloud DLP controls. ShinyHunters’ primary objective is data exfiltration from cloud platforms (Snowflake, AWS S3, Azure Blob, Salesforce). Implement DLP monitoring that detects unusual data access patterns, bulk downloads, and API-based exfiltration.
• Third-party supply chain audit. Review all third-party analytics, SaaS, and AI productivity tools with OAuth access to your environment. The Anodot vector demonstrates that third-party service account tokens provide silent, persistent access that bypasses standard login alerting.
• Engage Mjolnir Security for ongoing MTAC threat monitoring, 0ktapus detection rule development, and extortion response readiness assessment. Our sensors provide real-time visibility into ShinyHunters infrastructure that no commercial threat feed can match.

Mjolnir Security — Threat Intelligence & Data Extortion Response