Posts

, , , ,

Inside the ShinyHunters Breach

Inside the ShinyHunters Breach: How a Cybercrime Collective Outsmarted Google

By Skeeter Wesinger

August 26, 2025

In June 2025, a phone call was all it took to crack open one of the world’s most secure companies. Google, the billion-dollar titan that built Chrome, Gmail, and Android, didn’t fall to an exotic zero-day exploit or state-sponsored cyberweapon. Instead, it stumbled over a voice on the line.

The culprits were ShinyHunters, a name that has haunted cybersecurity teams for nearly half a decade. Their infiltration of Google’s Salesforce system—achieved by tricking an employee into installing a poisoned version of a trusted utility—didn’t yield passwords or credit card numbers. But what it did uncover, millions of names, emails, and phone numbers, was enough to unleash a global phishing storm and prove once again that the human element remains the weakest link in digital defense.

ShinyHunters first burst onto the scene in 2020, when massive troves of stolen data began appearing on underground forums. Early hits included databases from Tokopedia, Wattpad, and Microsoft’s private GitHub repositories. Over time, the group built a reputation as one of the most prolific sellers of stolen data, often releasing sample leaks for free to advertise their “work” before auctioning the rest to the highest bidder. Unlike some cybercrime groups that focus on a single specialty—ransomware, banking trojans, or nation-state espionage—ShinyHunters thrive on versatility. They have carried out brute-force intrusions, exploited cloud misconfigurations, and, as Google’s case shows, mastered social engineering. What ties their operations together is a single goal: monetization through chaos. Their name itself comes from the Pokémon community, where “shiny hunters” are players obsessively searching for rare, alternate-colored Pokémon. It’s a fitting metaphor—ShinyHunters sift through digital landscapes looking for rare weaknesses, exploiting them, and then flaunting their finds in dark corners of the internet.

The attack on Google was as elegant as it was devastating. ShinyHunters launched what cybersecurity experts call a vishing campaign—voice phishing. An employee received a convincing phone call from someone posing as IT support. The hacker guided the target into downloading what appeared to be Salesforce’s Data Loader, a legitimate tool used by administrators. Unbeknownst to the victim, the tool had been tampered with. Once installed, it silently granted ShinyHunters remote access to Google’s Salesforce instance. Within hours, they had siphoned off contact data for countless small and medium-sized business clients. The breach didn’t expose Gmail passwords or financial records, but in today’s digital ecosystem, raw contact data can be just as dangerous. The stolen information became ammunition for phishing campaigns that soon followed—calls, texts, and emails impersonating Google staff, many of them spoofed to look as though they came from Silicon Valley’s “650” area code.

This wasn’t ShinyHunters’ first high-profile strike. They’ve stolen databases from major corporations including AT&T, Mashable, and Bonobos. They’ve been linked to leaks affecting over 70 companies worldwide, racking up billions of compromised records. What sets them apart is not sheer volume but adaptability. In the early days, ShinyHunters focused on exploiting unsecured servers and developer platforms. As defenses improved, they pivoted to supply-chain vulnerabilities and cloud applications. Now, they’ve sharpened their social engineering skills to the point where a single phone call can topple a security program worth millions. Cybersecurity researchers note that ShinyHunters thrive in the gray zone between nuisance and catastrophe. They rarely pursue the destructive paths of ransomware groups, preferring instead to quietly drain data and monetize it on dark web markets. But their growing sophistication makes them a constant wildcard in the cybercrime underworld.

Google wasn’t the only target. The same campaign has been tied to breaches at other major corporations, including luxury brands, airlines, and financial institutions. The common thread is Salesforce, the ubiquitous customer relationship management platform that underpins business operations worldwide. By compromising a Salesforce instance, attackers gain not only a list of customers but also context—relationships, communication histories, even sales leads. That’s gold for scammers who thrive on credibility. A phishing email that mentions a real company, a real client, or a recent deal is far harder to dismiss as spam. Google’s prominence simply made it the most visible victim. If a company with Google’s security apparatus can be tricked, what chance does a regional retailer or midsize manufacturer have?

At its core, the ShinyHunters breach of Google demonstrates a troubling shift in cybercrime. For years, the focus was on software vulnerabilities—buffer overflows, unpatched servers, zero-days. Today, the battlefield is human psychology. ShinyHunters didn’t exploit an obscure flaw in Salesforce. They exploited belief. An employee believed the voice on the phone was legitimate. They believed the download link was safe. They believed the Data Loader tool was what it claimed to be. And belief, it turns out, is harder to patch than software.

Google has confirmed that the incident did not expose Gmail passwords, and it has urged users to adopt stronger protections such as two-factor authentication and passkeys. But the broader lesson goes beyond patches or new login methods. ShinyHunters’ success highlights the fragility of digital trust in an era when AI can generate flawless fake voices, craft convincing emails, and automate scams at scale. Tomorrow’s vishing call may sound exactly like your boss, your colleague, or your bank representative. The line between legitimate communication and malicious deception is blurring fast. For ShinyHunters, that blurring is the business model. And for the rest of us, it’s a reminder that the next major breach may not come from a flaw in the code, but from a flaw in ourselves. And these ShinyHunters use fake Gmail accounts, which will get them caught.

/by
, ,

Scattered Spider Attacks Again

Scattered Spider Attacks Again
By Skeeter Wesinger
July 2, 2025

In yet another brazen display of cyber subterfuge, Scattered Spider, the slick, shape-shifting cyber gang with a knack for con artistry, has struck again—this time sinking its fangs into Qantas Airways, compromising data on as many as six million unsuspecting customers. It wasn’t some arcane bit of code that cracked the system. It was human weakness, exploited like a well-worn key.
The breach targeted a third-party customer service platform, proving once again that it’s not always your network that gets hacked—it’s your vendor’s.
A Familiar Pattern, a New Victim
Qantas now joins the growing list of high-profile victims stalked by Scattered Spider, a crew whose previous hits include MGM Resorts, Caesars, Hawaiian Airlines, and WestJet. Their calling card? Social engineering at scale—not brute force, but charm, guile, and just enough personal data to sound like they belong.
They impersonate. They coax. They wear your company’s name like a mask—and by the time IT realizes what’s happened, they’re already inside.
This time, they walked away with customer names, emails, phone numbers, birthdates, and frequent flyer numbers. No passwords or payment data were accessed—Qantas was quick to say—but that’s cold comfort in an age when a birthday and an email address is all that it takes to hijack your digital life.
“Trust, but Verify” is Dead, well, sort of.
As Qantas CEO Vanessa Hudson issued the standard apology—support lines are open, regulators are notified, the sky is still safe. But the real damage isn’t operational. It’s existential. Trust doesn’t come back easy, especially when it’s breached by a whisper, not a weapon.
“We used to worry about firewalls and phishing links,” one insider told me. “Now it’s your own help desk that opens the front door.”
Scattered Spider doesn’t hack computers. They hack people—call center agents, IT support staff, even security teams—using their own policies and training scripts against them. Their English is fluent. Their confidence is absolute. Their patience is weaponized.
The Breach Beneath the Breach
What’s truly alarming isn’t just that Scattered Spider got in. It’s how.
They exploited a third-party vendor, the soft underbelly of every corporate tech stack. While Qantas brags about airline safety and digital transformation, it was a remote call-center platform—likely underpaid, overworked, and under-secured—that cracked first.
We’ve heard this story before. Optus. Medibank. Latitude. The names change. The failures rhyme.
And the hackers? They have evolved.
The Next Call May Already Be Happening
Scattered Spider is a ghost in the wires—a gang of young, highly skilled social engineers, some rumored to be based in the U.S., operating like a twisted start-up. Their tools aren’t viruses—they’re LinkedIn, ZoomInfo, and your own onboarding documents.
What you can do is rethink your threat model. Because the enemy isn’t always a shadowy figure in a hoodie. Sometimes it’s a cheerful voice saying, “Hi, I’m calling from IT—can you verify your employee ID?”
By then, it’s already too late. Need to hire an expert? Call me.

/by
, , , , , , ,

Scattered Spider

Scattered Spider: Impersonation, and Cybersecurity in the Age of Cloud Computing

By Skeeter Wesinger
June 29, 2025

In an era where companies have moved their infrastructure to the cloud and outsourced much of their IT, one old-fashioned tactic still defeats the most modern defenses: impersonation.
At the center of this threat is Scattered Spider, a cybercriminal collective that doesn’t exploit code—they exploit people. Their operations are quiet, persuasive, and dangerously effective. Instead of smashing through firewalls, they impersonate trusted employees—often convincingly enough to fool help desks, bypass multi-factor authentication, and gain access to critical systems without ever tripping an alarm.
This is the cybersecurity challenge of our time. Not ransomware. Not zero-days. But trust itself.
Who Is Scattered Spider?
Known to threat intelligence teams as UNC3944, Muddled Libra, or 0ktapus, Scattered Spider is an English-speaking group that has compromised some of the most security-aware companies in North America. Their breaches at MGM Resorts and Caesars Entertainment made headlines—not because they used sophisticated malware, but because they didn’t have to.
Their weapon of choice is the phone call. A help desk technician receives a request from someone claiming to be a senior executive who lost their device. The impersonator is articulate, knowledgeable, and urgent. They know internal jargon. They cite real names. Sometimes, they even use AI-generated voices.
And too often, it works. The attacker gets a password reset, reroutes MFA codes, and slips in undetected.
The Illusion of Familiarity
What makes these attackers so dangerous is their ability to sound familiar. They don’t just say the right things—they say them the right way. They mirror internal language. They speak with confidence. They understand hierarchy. They’re skilled impersonators, and they prey on a simple reflex: the desire to help.
In the past, we might have trusted our ears. “It sounded like them,” someone might say.
But in the age of AI, “sounding like them” is no longer proof of identity. It’s a liability.
When Cloud Isn’t the Cure
Many organizations have moved to cloud-based environments under the assumption that centralization and managed services will reduce their exposure. In some ways, they’re right: the cloud simplifies infrastructure and offloads security operations. But here’s the truth: you can’t outsource responsibility. The human layer remains—and that’s precisely where Scattered Spider operates.
They don’t need to breach Azure or AWS. They just need to impersonate someone with access to it.
It’s time we stop treating “trust but verify” as a cliché and start treating it as operational policy. Better yet: trust—but always verify. Every request. Every reset. Every exception.
Verification today means more than checking a box. It requires multi-channel authentication. It means never resetting MFA or passwords based solely on a phone call, no matter how credible the caller seems. It means locking down help desk protocols so impersonation doesn’t slip through the cracks.
Security teams must also monitor legitimate tools—like AnyDesk, TeamViewer, and ScreenConnect—that attackers often use once inside. These aren’t inherently malicious, but in the wrong hands, they’re devastating.
And above all, organizations must train their frontline personnel—especially support staff—to treat every identity request with healthy skepticism. If your instinct says something feels off, pause and verify through secure channels. Escalate. Slow down. Ask the questions attackers hope you won’t.
Scattered Spider doesn’t hack your servers. They hack your systems of trust. They bypass encryption by impersonating authority. And they exploit the one vulnerability no software can patch: assumption.
As we continue shifting toward remote work, outsourced IT, and cloud-based everything, the real threat isn’t technical—it’s personal. It’s the voice on the line. The urgent request. The person who “sounds right.”
In this world, cybersecurity isn’t just about what you build. It’s about what you believe—and what you’re willing to question.
Therefore, you have to train your teams. Harden your protocols. And remember in the age of the cloud, the most important firewall is still human.
Trust—but always verify!

/by
, ,

When Cybersecurity Is an Afterthought

When Cybersecurity Is an Afterthought: The Victoria’s Secret Breach and the Looming Threat to E-Commerce
By Skeeter Wesinger
May 30, 2025

Victoria’s Secret recently experienced a significant cybersecurity incident that led to the temporary shutdown of its U.S. website and the suspension of certain in-store services. The company stated, “We have taken down our website and some in-store services as a precaution,” emphasizing their commitment to restoring operations securely.
While the exact nature of the breach remains undisclosed, the incident aligns with a series of cyberattacks targeting major retailers. Notably, the threat group known as Scattered Spider has been linked to similar attacks on UK retailers, including Marks & Spencer and Harrods. Security experts suggest that the tactics employed in the Victoria’s Secret breach bear a resemblance to those used by this group.
The impact of the breach extended beyond the digital storefront. Reports indicate disruptions to internal operations, including employee email access and distribution center functions. Customers faced challenges in placing orders, redeeming coupons, and accessing customer service.
Financially, the incident had immediate repercussions. Victoria’s Secret’s stock experienced a decline of approximately 7%, reflecting investor concerns over the implications of the breach.
This event highlights a broader issue: the persistent vulnerability of retailers to cyber threats, which is often exacerbated by inadequate adherence to cybersecurity protocols. Despite the increasing frequency of such attacks, many organizations remain underprepared, lacking robust security measures and comprehensive response plans.
Furthermore, the reluctance of some companies to disclose breaches hampers collective efforts to understand and mitigate cyber threats. Transparency is crucial in fostering a collaborative defense against increasingly sophisticated cybercriminals.
In conclusion, the Victoria’s Secret breach serves as a stark reminder of the critical importance of proactive cybersecurity measures. Retailers must prioritize the implementation of comprehensive security protocols, regular system audits, and employee training to safeguard against future incidents. The cost of inaction is not just financial but also erodes consumer trust and brand integrity.

/by
, , ,

In a classic phishing move

In a classic phishing move: spoofing a legit security company like VadeSecure to make the email look trustworthy. Irony at its finest—phishers pretending to be the anti-phishing experts.

Here’s what’s likely going on:

  • vadesecure.com is being spoofed—the return address is faked to show their domain, but the email didn’t actually come from Vade’s servers.

  • Or the phishers are using a lookalike domain (e.g., vadesecure-support.com or vadesecure-mail.com) to trick people not paying close attention.

If you still have the email:

  • You can check the email headers to see the real “from” server (look for Return-Path and Received lines).

  • If the SPF/DKIM/DMARC checks fail in the headers, that’s confirmation it’s spoofed.

  • You can also report it to VadeSecure directly at: abuse@vadesecure.com

By Skeeter Wesinger

March 26, 2025

/by
, , , ,

Tiger Team Tools

In the ever-evolving landscape of cybersecurity, where every vulnerability is a potential chink in the armor, penetration testers, often known as “Tiger Teams,” are equipped with an array of sophisticated tools to expose the frailties of modern networks and systems. These tools, while small in stature, are formidable in function.


Take, for instance, the Plunder Bug. It is no larger than a thumb drive but operates with the efficiency of a seasoned spy. Its purpose is passive yet critical: network sniffing. When embedded between a device and a network connection, it quietly captures traffic without interfering, all while remaining undetected. Plugged into a mobile device via USB, it provides real-time insights into network vulnerabilities, offering testers a mobile command center from which they can dissect the data flow.
Then there’s the Shark Jack, a sleek, portable penetration tool that embodies the speed and stealth of its namesake. This tool connects swiftly to a network, scanning it for weaknesses with a precision akin to a predator stalking its prey. Whether it’s identifying vulnerable devices or launching automated attacks, such as exploiting open ports, the Shark Jack serves as an efficient reconnaissance agent, laying bare the weak points of a wired network with ease.
The Bash Bunny is another versatile tool in the Tiger Team’s arsenal, designed to mimic trusted devices. Disguised as a simple USB device, it is a shape-shifter in the realm of penetration testing. Plugged into a target system, it becomes whatever the system desires—be it a keyboard or a mass storage device. But underneath this guise, it executes pre-written scripts, harvesting credentials, exfiltrating data, and injecting malicious payloads with surgical precision. It performs its tasks swiftly, leaving no trace save the evidence it seeks to uncover.
And who could overlook the infamous USB Rubber Ducky that appears to be innocuous enough, resembling the average USB drive one might carry in a pocket with a rubber ducky on the side. However, it is as dangerous as a loaded 44 magnum in the right hands. When connected to an unlocked system, it transforms into a virtual keyboard, inputting keystrokes at a speed no human could rival. A simple script loaded onto the Ducky can compromise a system in seconds, launching commands, creating backdoors, or altering configurations—all with the rapidity of a few automated keystrokes.
However, these tools are not limited to devices inserted by hand. There are Implants for Stealthy Access hardware planted within target environments for long-term, covert observation. Like an embedded spy within a fortified city, these implants lurk unnoticed in routers or servers, conducting surveillance, launching tests, and communicating remotely with their controllers. In the right hands, these hidden devices provide persistent access, gathering intelligence and launching attacks with impunity.
The Land Turtle is another clandestine agent designed for covert penetration. Small and unassuming, it plugs into an Ethernet port, immediately granting access to the network. Remotely controlled, it allows testers to move through the system undetected, pivoting to different points and exploiting vulnerabilities in real-time. Its low profile belies its formidable capabilities, which range from reconnaissance to remote control.
The Packet Squirrel performs its tasks in a similarly understated manner, manipulating packets of data with ease. Like its forest-dwelling counterpart, it is quick and nimble, placed between network connections where it sniffs packets, analyzing traffic for weaknesses or manipulating data to launch attacks like the dreaded Man-in-the-Middle (MitM).
Not to be forgotten is the OMG Cable, a wolf in sheep’s clothing if ever there was one. To the untrained eye, it is indistinguishable from an ordinary USB or Lightning cable. Yet inside this innocent facade lies a powerful weapon capable of injecting keystrokes and remotely controlling a target system. Its very design is its greatest strength—appearing harmless until the moment of attack, it can be deployed in environments where traditional tools might be too conspicuous.
Of course, in the world of wireless networks, the WiFi Pineapple reigns supreme. It is the master of deception, impersonating legitimate access points to lure unsuspecting devices into its web. Once connected, the Pineapple enables testers—or attackers—to intercept data, manipulate traffic, and launch MitM attacks. It is a tool that is both feared and respected, and it is able to compromise entire networks from a single-entry point.
And finally, we must acknowledge fufAI, a cutting-edge example of how artificial intelligence is revolutionizing penetration testing. This tool marries AI’s computational might with the time-honored practice of file fuzzing, probing for vulnerabilities with an intelligence and speed beyond that of its human counterparts. It is a tool of the future, yet its mission remains timeless: to uncover and exploit the weaknesses that others miss.
These are just a few of the tools in the Tiger Team’s ever-expanding toolbox. Each one plays its role in the grander strategy of penetration testing, revealing the vulnerabilities that lie hidden beneath the surface, waiting for the unwary to stumble.

By Skeeter Wesinger

September 30, 2024

References:
Jabbour, Kamal, and Jenny Poisson. “Cyber Risk Assessment in Distributed Information Systems.” The Cyber Defense Review 1, no. 1 (2016): 91–112.
http://www.jstor.org/stable/26267301.

/by