The MFA-Bypass Playbook
ShinyHunters has moved past basic phishing. The group now exploits trusted identity flows and business logic to bypass MFA, a shift that makes its 2025–2026 operations significantly harder to defend against than the classic intrusion chains it used in 2020.
The UNC6040 campaign demonstrates the full playbook. The attacker calls the help desk, impersonates an internal user, and resets credentials through a malicious Salesforce connected app. A stolen OAuth token completes the chain, giving the attacker access to the target environment without the user ever entering a password or MFA prompt.
Who Is ShinyHunters in 2026
ShinyHunters built its reputation in 2020 as a high-volume database broker, selling stolen credentials and bulk data on RaidForums and BreachForums. That origin story explains why the group has survived three forum seizures, five administrator arrests across three separate operations, and the extradition and sentencing of founder Sébastien Raoult, with five admins pulled in France in 2025.
By 2025, the brand expanded into the Scattered LAPSUS$ Hunters (SLH) federation, a merger that combines ShinyHunters’ data brokerage, Scattered Spider’s social engineering, and LAPSUS$’s aggressive exfiltration tactics. The federation now operates under a single brand, which is why the 2025–2026 Salesforce and SaaS campaigns carry the ShinyHunters name even when the underlying work is Scattered Spider or LAPSUS$.
Why It Keeps Surviving
The brand has outlived three forum seizures: RaidForums once, BreachForums twice. Each time, ShinyHunters reappeared within days or weeks, re-listing data and continuing to sell under the same name.
That resilience is organizational, not technical. It is a reusable identity that survives arrests, platform losses, and operator turnover. Dismantling the infrastructure does not eliminate the brand, and pulling the operators does not change the underlying tactics. By 2025, the identity expanded into the Scattered LAPSUS$ Hunters federation, which is why the 2025–2026 campaigns carry the ShinyHunters name even when the work is Scattered Spider or LAPSUS$ underneath.
What Defenders Need to Fix
The first fix is the one that stops the chain. Enforce phishing-resistant MFA for every privileged SaaS role. That means WebAuthn or FIDO2 for the help-desk and admin accounts that reset credentials, not the TOTP or SMS fallback that ShinyHunters has been bypassing since 2024. If the role can reset a user’s password or approve an OAuth app, it needs a hardware key. The UNC6040 campaign works because the help desk still trusts the voice and the reset flow still issues a token the attacker can replay.
The second fix is the one that stops the token. Audit and allow-list every OAuth-connected app across Salesforce. The campaign works by registering a malicious connected app that inherits the same OAuth scope as the legitimate integration. If the app isn’t on the allow-list, it shouldn’t be there. This is the same pattern that let the group inherit access to 760 Salesforce tenants through a single Drift integration. Defenders who let any third-party app connect to the org are the ones getting hit. The allow-list should be enforced at the org level, not left to each admin to approve the app in the UI.
The third fix is the one that stops the data. Treat the extortion activity as an incident trigger, not a PR problem. The group publishes a compressed archive when the target declines to pay, which is why the leak site went live in October 2025. If the data is already on the leak site, the incident is over. The pattern is consistent: ShinyHunters exfiltrates, demands ransom, and publishes the archive when the target says no. That means the incident response window is the time between the help-desk call and the first archive drop, not the time after the leak site is public. If the target is treating the leak as a PR event, the data was already out the door.
Key points
- ShinyHunters bypasses MFA by vishing the help desk, installing a malicious Salesforce connected app, and harvesting an OAuth token.
- The UNC6040 campaign targets Salesforce, Salesloft Drift, Gainsight, and similar third-party SaaS integrations.
- The group has survived three forum seizures (RaidForums, BreachForums x2), five admin arrests, and founder Sébastien Raoult's conviction.
- By 2025 the brand merged into the Scattered LAPSUS$ Hunters (SLH) federation, combining ShinyHunters, Scattered Spider, and LAPSUS$.
- Defenders must enforce phishing-resistant MFA for privileged SaaS roles and allow-list OAuth-connected apps across Salesforce.
Further reading & sources
- Cato CTRL™ Threat Actor Profile: ShinyHunters – The Brand That Outlasts the Takedowns — Cato Networks
- 34 Biggest Healthcare Data Breaches (Updated July 2026) | UpGuard
- 26 Biggest Data Breaches in Finance (Updated July 2026) | UpGuard
- Biggest Data Breaches in Retail (Updated August 2026) | UpGuard
- 23 Biggest Data Breaches in Australia (Updated July 2026) | UpGuard
- The 40 Biggest Data Breaches of All Time (Updated July 2026) | UpGuard
- The FBI wrote down the Scattered Spider playbook, and it starts with a phone call by Lucie Cardiet
- New Ransomware ShinySp1der: What Is It and How Does It Operate?
- Who are Jaguar Land Rover cyber attack hackers as Scattered Lapsus$ Hunters issue key statement | Coventry Live
- Who are Jaguar Land Rover cyber attack hackers? Scattered Lapsus$ Hunters issue statement - Birmingham Live
- Hackers linked to M&S breach claim responsibility for Jaguar Land Rover cyber-attack | Jaguar Land Rover | The Guardian
- M&S hackers claim to be behind Jaguar Land Rover cyber attack