weekly

SIGNALS WEEKLY: ShinyHunters, Vishing, and the MFA Hijack Problem in SaaS

MFA isn’t “done.” It’s now the excuse attackers use on the phone. ☎️😈🔑 Vishing → MFA reset/re-enroll → post-login SaaS data grabs. Plus: selective Notepad++ updater abuse + proxy traffic making IP rep cry.

Wes

Wes

— 6 min read
SIGNALS WEEKLY: ShinyHunters, Vishing, and the MFA Hijack Problem in SaaS

TL;DR

  • [Supply Chain] Notepad++ infrastructure compromise enabled highly targeted malware delivery via trusted auto-updates; 2025-era installs on dev/admin endpoints warrant retroactive hunting and integrity validation checks for other updaters.

  • [Identity & SaaS] ShinyHunters-branded actors and cross-platform infostealers are shifting intrusions toward vishing-led account takeover and post-login SaaS abuse (token/session theft, MFA reset/re-enrollment), outpacing pure exploit-based access.

  • [Edge & Infrastructure] Active exploitation of Fortinet SSO (CVE-2026-24858), Ivanti EPMM (CVE-2026-1281), and IIS (UAT-8099 webshell + BadIIS) shows attackers converging on edge auth, MDM, and web servers as durable footholds, often hidden behind residential proxy networks.

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe!

Like this? Forward this to a friend!

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Read more