Overview
A financially-motivated criminal group known as ShinyHunters (tracked by Google/Mandiant as UNC6040, with sister clusters Cordial Spider and Snarky Spider — the new generation of “Scattered Spider”) has spent 2025–2026 breaching over 1,000 organizations and exfiltrating an estimated 1.5 billion records from SaaS platforms — primarily Salesforce, Okta, and Salesloft.
Email is not the entry point. They start with a phone call. An attacker — often using an AI voice agent that can adapt to your responses in real time — calls an employee while spoofing the company's own IT helpdesk number, and walks them through approving an MFA prompt, reading out an SSO/device code, or authorizing a malicious “connected app.” That single approval grants API-level access to the company's CRM, and bulk data export and extortion follow within hours.
Because the initial vector is a phone call, no email security platform alone can stop this attack. Defense depends on employee muscle memory and helpdesk policy. This advisory exists to make sure your team has both.
Confirmed Victims (Partial List)
The campaign is targeting organizations with mature security programs, dedicated SOCs, and full MFA deployments. The attack works because users approve it themselves:
How the Call Unfolds
Caller ID matches your IT helpdesk or a known internal extension — spoofed. The caller may know your name, your manager, an open ticket number, or a recent password reset, lifted from LinkedIn, prior breach data, or social engineering of another employee. The voice is often an AI agent that adapts to your responses in real time.
Scripts you may hear:
- “We're seeing a security incident on your account.”
- “Your MFA is de-syncing and you'll be locked out in five minutes.”
- “We're pushing an emergency Salesforce / Okta security update right now.”
You're directed to a domain that follows combosquatting patterns:
my<company>internal.com, <company>sso.com,
okta-<company>.com. Push Security tracks 12+ distinct device-code phishing kits
actively used in these campaigns.
The caller asks you to perform one of:
- Approve an MFA push notification on your phone “to confirm we're talking to the right person.”
- Read back an 8–12 character device code shown on the page.
- Click “Allow” / “Authorize” on a Salesforce connected-app prompt — often a re-branded “Data Loader.”
The connected-app authorization grants persistent API access independent of the user's password or MFA. Hours later, the attacker bulk-exports your CRM via legitimate APIs. The extortion email typically arrives within a few days.
Red Flags — What to Watch For
- Unsolicited inbound call from “IT” or “Security” that you didn't request.
- Urgency. “Right now,” “before you get locked out,” “this expires in five minutes.”
- An MFA push you didn't initiate — the caller asks you to approve it.
- Asked to read out a code shown on a webpage. This is a device-code phishing tell.
- Asked to authorize a “connected app” or install something from a non-standard URL.
- The voice sounds slightly off — over-scripted, oddly paced, or has a brief silence before answering unexpected questions. These are AI agents.
- Caller knows internal details but pressures you not to verify through normal channels.
If You Get a Call Like This
- Hang up. Don't argue, don't explain, don't apologize. Just hang up.
- Call IT back using the number on your intranet or badge — never the number that called you.
- Report the call to your security team even if you didn't fall for it. Other employees are being called too.
- Never approve an MFA prompt you didn't start.
- Never read a login code, device code, or one-time password to anyone on the phone. IT will never ask for this.
- Never authorize a connected app, OAuth grant, or “Data Loader” during a phone call.
- Never log in via a URL someone read to you over the phone.
For Administrators & Helpdesk Staff
- Require live video + physical government ID verification for any password / MFA reset request.
- Disable end-user OAuth grants for connected apps in Salesforce — make admin approval mandatory.
- Restrict Salesforce Data Loader and similar API tools to allow-listed IP ranges.
- Enable Okta's device assurance / managed-device requirement for SSO.
- Move from push-based MFA to phishing-resistant MFA (FIDO2 / WebAuthn / security keys).
- Alert on new connected-app authorizations and on bulk API export volume in your SaaS audit logs.
- Run a tabletop: “What does your helpdesk do if someone calls claiming they're locked out and need an MFA reset?”
Where OpenEFA Fits
Vishing breaches do not start in email, so no email gateway alone can stop them. OpenEFA's posture is structured to reduce blast radius when one of these campaigns brushes against your environment:
Shipped May 10, 2026. OpenEFA administrator accounts can now enroll FIDO2 / WebAuthn credentials as a third MFA factor — the only MFA class that cannot be phished over the phone, because there is no code to read out and no push to approve out-of-context.
Once a victim is breached, follow-on extortion email and credential-harvest waves get sent to the rest of the org. OpenEFA's intent modeling, first-contact detection, and the EFA Collective threat intelligence feed catch these secondary campaigns even when the sender authenticates cleanly.
When attackers send the lookalike Salesforce / Okta consent-page link via email instead of phone,
OpenEFA's URL reputation, brand impersonation, and combosquatting detectors are explicitly tuned for
the my<company>internal.com / okta-<company>.com pattern.
Further Reading
Report a Suspicious Call
If you've received a call matching this pattern — or worse, if you think you may have approved a prompt and want help triaging — contact OpenEFA support immediately at support@openefa.com.