Topic starter
06/09/2026 3:45 pm
TL;DR: Mandiant’s late-January 2026 research shows ShinyHunters-branded actors using vishing, victim-branded credential harvesters, and MFA code capture to break into SaaS accounts and steal data for extortion, according to Vorlon. The lesson is that authentication strength alone does not stop social engineering when help desk flows, session handling, and SaaS-native exfiltration controls remain weak.
Editorial analysis by NHI Mgmt Group, based on content published by Vorlon: “Mandiant Research on ShinyHunters Vishing: Why MFA-enabled Doesn’t Mean Protected”.
Key questions
Q: What should teams do first when vishing starts targeting SaaS accounts?
A: First, revoke active sessions, app authorisations, and suspicious MFA enrollments before the attacker can turn a valid login into durable access.
Q: Why do MFA codes still fail against vishing attacks?
A: MFA codes fail when the attacker can harvest them in real time and replay them inside the valid session window.
Q: What are the signs that a SaaS-to-SaaS integration has been compromised?
A: Look for unusual query volume, bulk data exports, unexpected changes to integration behavior, and access from unfamiliar infrastructure.
Practitioner guidance
- Harden help desk verification Require stronger identity checks for password resets, MFA changes, and device enrollment so inbound calls cannot easily redirect trust.
- Move privileged users to phishing-resistant MFA Prioritise passkeys or FIDO2-style security keys for administrators and other high-value accounts where social engineering risk is highest.
- Revoke sessions and OAuth authorisations quickly Predefine who can cut off active sessions, app tokens, and authorisations across the IdP and SaaS stack when compromise is suspected.
Bottom line: Vishing succeeds when identity controls are undermined by support workflows, factor changes, and user pressure rather than by malware or a software exploit.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 3:45 pm
Authentication strength is not the same as authentication resilience: MFA and SSO can still fail operationally when the user is persuaded to participate in the attacker’s workflow. The control authenticates the session, but the social process around it has already been compromised. That distinction matters because many identity programmes still treat factor strength as the endpoint rather than the beginning of the control surface. Practitioners should reframe authentication as a human-mediated process, not a purely technical gate.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How should security teams implement phishing-resistant authentication without hurting adoption?
A: Start with the highest-risk populations and applications, then offer the simplest usable authenticators that still meet your assurance target. Build recovery, enrollment, and help desk processes at the same time. If users cannot enroll and recover reliably, they will route around the control and weaken the programme.
👉 Read our full editorial: Vishing-driven SaaS compromise exposes the limits of MFA and SSO