Product
ShinyHunters OAuth Abuse Targeting SaaS Applications
6 TTPsShinyHunters, and related threat actor Storm-3138, conducted campaigns between mid-2025 and mid-2026 by employing voice phishing, supply chain compromise, and misconfigured guest access to abuse trusted OAuth relationships in SaaS applications like Salesforce, leading to unauthorized access, data exfiltration, and persistence.
Microsoft Security Updates — July 2026
10 CVEs 227 IOCsRoundup of Microsoft security advisories published in July 2026.
ShinyHunters Ransomware Group Claims icsecurity.com Victim, Exfiltrates 2.7M Records
2 rules 7 TTPs 2 CVEs 13 IOCsThe financially motivated ShinyHunters ransomware group, operating its shinysp1d3r RaaS, has claimed icsecurity.com as a new victim, compromising over 2.7 million records via credential stuffing and exploitation of cloud services like Snowflake, with the intent to extort through data leakage.
UNC6671 BlackFile Vishing Extortion Campaign Targeting Microsoft 365 and Okta
2 rules 8 TTPs 5 IOCsUNC6671, operating under the "BlackFile" brand, conducts a sophisticated extortion campaign targeting organizations through voice phishing (vishing) and single sign-on (SSO) compromise, using adversary-in-the-middle (AiTM) techniques to bypass MFA and exfiltrate sensitive corporate data.