ShinyHunters: The Token Theft Your MFA Can’t Stop | Ep 202
Show notes
What happens when your entire security investment means nothing? In this episode, Brad and Spencer break down how ShinyHunters and related groups like Scattered Spider and Lapsus$ keep getting in through social engineering, no exploit required. They call your users posing as real IT staff, sometimes with AI voices tuned to sound local, and walk them into handing over session tokens and cookies. The attackers already have a session, so MFA and conditional access don’t stop them.
Spencer shares a lab test where a compliant device conditional access policy was bypassed by replaying cookies from an exported HAR file. Brad explains why the SSO handoff to third-party SaaS apps like Salesforce and document management systems leaves you relying on weaker session security. The hosts also cover why these intrusions are so hard to see in logs and what defenders can do about it.
In this episode:
- Who ShinyHunters are and why they focus on data extortion, not ransomware
- How vishing and AI voice masking make these calls convincing
- Why attackers are after session tokens, not credentials
- How the SSO handoff to third-party SaaS apps sidesteps Microsoft protections
- Why law firm DMS platforms are a top target for bulk data theft
- Why stolen sessions rarely show up in Entra sign-in logs or SaaS login records
- Using deception assets as high-fidelity, low-cost detection
- Authentication brokers and named locations as a mitigation
- Why tenant reviews and purple teaming beat assumptions
Need help testing whether your environment can withstand session token theft? SecurIT360 offers penetration testing, purple teaming, and offensive security services. Visit securit360.com to learn more.
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com