Notifications
Clear all
Topic starter
06/09/2026 3:45 pm
TL;DR: Mandiant’s late-January 2026 research shows ShinyHunters-branded actors using vishing, victim-branded credential harvesters, and MFA code capture to break into SaaS accounts and steal data for extortion, according to Vorlon. The lesson is that authentication strength alone does not stop social engineering when help desk flows, session handling, and SaaS-native exfiltration controls remain weak.
NHIMG editorial — based on content published by Vorlon: vishing-driven SaaS compromise, MFA limitations, and identity response guidance
By the numbers:
- The ratio of non-human to human identities now exceeds 100:1 in enterprise environments.
Questions worth separating out
Q: What breaks when attackers get a legitimate login through vishing or MFA abuse?
A: The assumption that a successful login indicates trusted behaviour breaks immediately.
Q: Why do valid SSO sessions still lead to data theft after phishing?
A: A valid session can still be unsafe because SaaS access often persists through bearer tokens, OAuth grants, and device trust that outlive the original login.
Q: How can security teams spot vishing-driven compromise before exfiltration starts?
A: Look for a cluster of identity changes rather than a single sign-in event.
Practitioner guidance
- Harden password reset and MFA change workflows Require higher-assurance verification for resets, factor enrollment, and support requests that change authentication state.
- Move high-risk users to phishing-resistant MFA Prioritise passkeys or FIDO2 security keys for administrators and high-impact roles where code theft and prompt abuse are most damaging.
- Revoke sessions and OAuth authorisations immediately Build a containment runbook that can remove active sessions, clean up OAuth grants, and block attacker-controlled device enrollment across both the IdP and core SaaS apps.
What's in the full article
Vorlon's full article covers the operational detail this post intentionally leaves for the source:
- A practical containment sequence for revoking sessions, OAuth grants, and suspicious device enrollments across identity and SaaS layers
- A walkthrough of how the platform maps interconnected SaaS and AI environments to expose sensitive activity paths
- Specific detection patterns for new authorisations, abnormal API behaviour, and high-signal data movement events
- Implementation detail on how teams can route revocation workflows through existing operational processes
👉 Read Vorlon's analysis of vishing-driven SaaS compromise and MFA failure modes →
Vishing-based SaaS compromise: are your controls keeping up?
Explore further
06/09/2026 3:45 pm
Vishing is a human identity failure that becomes a SaaS governance problem. The attack starts with a person and ends inside authenticated business applications, which means IAM teams cannot isolate the event to login security alone. The interesting failure is not that MFA exists, but that recovery, enrollment, and session handling remain exploitable by social pressure. Practitioners should treat help desk process and SaaS auditability as part of the identity control plane.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared with nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Should organisations prioritise phishing-resistant MFA or SaaS audit logging first?
A: If the immediate risk is credential or prompt theft, phishing-resistant MFA should come first for high-risk users because it reduces the chance of successful coercion. If the organisation already has that in place, SaaS audit logging becomes the next priority because attackers often pivot from login compromise to native exports and downloads. Mature programmes need both.
👉 Read our full editorial: Vishing-driven SaaS compromise exposes the limits of MFA and SSO
