Threat Spotlight: ShinyHunters Fast-Tracks SaaS Access with Subdomain Impersonation

The threat group ShinyHunters has adopted a new tactic of subdomain impersonation for initial access, moving away from newly registered lookalike domains. They are utilizing mobile-first lures and outsourcing spam services to scale their operations. The group is likely reusing previously stolen CRM and ERP data to drive social engineering attacks. Their approach involves phone-guided adversary-in-the-middle phishing to capture credentials and authenticated sessions. ShinyHunters is also scaling vishing operations through paid contractors and specialized harassment services. This evolution in tactics allows for rapid identity-to-SaaS compromise without deploying malware, making traditional domain-based monitoring less effective.

• Inside a Global Procurement-Themed AiTM Phishing CampaignPhishing2026-07-22
• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28
• DarkCore: A Data-Theft RAT With a Session-Hijacking BrowserMalware2026-10-27
• Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial AccessCampaign2026-10-26
• The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessionsMalware2026-09-16