Topic starter
10/06/2026 11:52 pm
TL;DR: Scattered Lapsus$ Hunters are combining vishing with adversary-in-the-middle phishing to steal SSO credentials, MFA codes, and live sessions from hundreds of organisations across Okta, Entra, and Google, according to Push Security. The attack works because identity-first compromise bypasses endpoint and network controls and turns SSO into the blast-radius multiplier.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “Unpacking the latest SLH campaign â combining vishing with AiTM phishing to hijack SSO accounts”.
Key questions
Q: What breaks when vishing is combined with AiTM phishing against SSO accounts?
A: The failure is the assumption that authentication happens in a trusted, static channel.
Q: Why do SSO compromises create such broad downstream risk?
A: Because the primary login becomes a control plane for many connected applications.
Q: What are the signs that an identity provider account has been abused through phishing?
A: Look for unusual MFA enrolment changes, unexpected passkey creation, logins from uncharacteristic browser or device combinations, and new sessions followed by rapid access to multiple SaaS applications.
Practitioner guidance
- Harden SSO recovery and help-desk verification Require out-of-band identity verification for password resets, MFA changes and passkey enrolment so voice-based impersonation cannot drive account takeover.
- Detect live session theft in the browser Use browser telemetry to flag cloned login pages, suspicious login flows and real-time MFA relay behaviour before the session is established.
- Review downstream application exposure Map which SaaS platforms inherit access from each primary SSO identity so a single compromised login can be contained quickly.
Bottom line: Hybrid vishing plus AiTM phishing turns SSO into a broad access gateway, so one compromised login can expose multiple connected services at once.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 6:17 am
SSO compromise has become an access multiplier, not a login event: Once an attacker reaches the identity provider, the real target is the downstream application graph. The article shows why federated access concentrates risk into a single session boundary that was never designed to carry this much trust. For practitioners, SSO must be governed as a high-blast-radius control plane, not just an authentication convenience.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations prioritise passkeys over browser-based detection for SSO protection?
A: No single control is enough on its own. Passkeys reduce phishing success, but browser-based detection helps catch live AiTM pages and operator-led attacks that still get a user to interact. The strongest posture combines phishing-resistant authentication, browser-level inspection and tight recovery governance.
👉 Read our full editorial: Hybrid vishing and AiTM phishing are reshaping SSO defense
This post was modified 1 day ago by NHI Mgmt Group