ShinyHunters Exploit Vishing, Help Desk to Steal SaaS Data via SSO

Health-ISAC warns of rising ShinyHunters attacks using vishing and help desk manipulation to compromise SSO and steal data from healthcare orgs. Attackers impersonate IT support to reset passwords and MFA, then access M365, Salesforce, and other SaaS apps. The group targets bulk data theft via legitimate sessions, often without malware.