ShinyHunters Targets Okta SSO with Vishing Attacks

The ShinyHunters cybercrime group has launched an active and ongoing voice-phishing (vishing) campaign targeting more than 150 organizations worldwide, abusing human trust to bypass multi-factor authentication (MFA) and steal cloud credentials. The attacks focus heavily on enterprises using Okta single sign-on (SSO), a gateway to critical business systems.

ShinyHunters operators use sophisticated, real-time phishing kits powered by Socket.IO relays to impersonate trusted identity providers such as Okta, Microsoft, and Google. Victims receive convincing phone calls that create urgency—often posing as IT or security teams—prompting employees to disclose login credentials or approve MFA push requests. Once access is gained, attackers rapidly exfiltrate data from platforms like Microsoft 365, Salesforce, and Google Workspace before issuing extortion demands.

Security researchers estimate over 150 domains have been targeted, including organizations linked to Atlassian, Canva, Epic Games, HubSpot, Moderna, SoundCloud, WeWork, Crunchbase, and Betterment. The affected sectors span technology, finance, healthcare, and SaaS. Okta has warned that these phishing kits are now being sold “as a service,” dramatically lowering the barrier for large-scale abuse.

SSO platforms act as master keys, unlocking entire enterprise ecosystems—from email and CRM systems to collaboration tools. While MFA is widely deployed, ShinyHunters exploits human behavior, socially engineering users to approve access or bypass number-matching protections. Okta threat intelligence reports a sharp rise in vishing volumes as attackers adapt to stronger browser-based defenses.

Indian IT services firms and BPOs, including major Okta users, face heightened exposure under India’s DPDP Act, where breaches carry strict reporting and compliance obligations. The growing use of AI-powered deepfake voice attacks further amplifies the threat.

Experts recommend shifting from push-based MFA to FIDO2 passkeys, conducting regular vishing simulations, tightening Okta adaptive MFA policies, monitoring known indicators of compromise, and enforcing zero-trust segmentation.

ShinyHunters’ campaign underscores a stark reality: social engineering now outpaces technical exploits. As AI-driven vishing scales, enterprises must strengthen the human layer of cybersecurity as rigorously as their technology stack.