FlagThis — Daily Cybersecurity Intelligence Briefing

Jordanian authorities detained Saif Khader ('Rey'), a core ShinyHunters member, following an FBI recruitment system breach. Attackers leveraged phishing lures via fbi-recruit.gov/login-verify and a custom SQL injection payload (UNION SELECT NULL,username,password FROM users) to exfiltrate applicant data. Post-exploitation utilized Cobalt Strike beacons (updateservice.cloud, statsapi.net) and Mimikatz for credential harvesting. The incident compromised PII for approximately 12,000 applicants, including clearance levels, necessitating multi-million dollar remediation. Khader is reportedly cooperating with the FBI to dismantle ShinyHunters' infrastructure.

McKesson Corporation suffered a significant data breach detected on August 25, 2026, resulting in the alleged exfiltration of 284 million Protected Health Information (PHI) records by the threat actor ShinyHunters. The attack utilized a vishing-based social engineering campaign to obtain administrative credentials for an unnamed third-party application, enabling a supply chain compromise. The incident underscores critical failures in third-party identity and access management (IAM) and highlights the systemic risk of relying on non-phishing-resistant authentication for critical healthcare logistics infrastructure.

Between mid-2025 and mid-2026, threat actor ShinyHunters (UNC604/UNC6395) targeted Salesforce and interconnected SaaS environments using an identity-centric attack chain. The group bypassed perimeter defenses by utilizing vishing and supply chain compromises to gain initial access, subsequently exploiting misconfigured guest permissions to authorize malicious OAuth applications. By securing long-lived OAuth tokens and manipulating trusted SaaS-to-SaaS integrations, the actors achieved persistent, high-privilege access to sensitive enterprise data. This campaign avoided CVE-based exploitation, focusing instead on the abuse of OAuth trust mechanisms to facilitate large-scale data exfiltration while evading traditional vulnerability scanners.

In May 2026, the threat group ShinyHunters exfiltrated 234 GB of sensitive data from dental benefits administrator DentaQuest. The breach compromised Protected Health Information (PHI) and Personally Identifiable Information (PII), including Social Security numbers and longitudinal clinical records for an estimated 26 million individuals. Initial forensic indicators suggest the attack vector involved either credential stuffing or the exploitation of third-party software vulnerabilities. Following unsuccessful ransom negotiations, the actor published the dataset on a Tor-based leak site. The incident has triggered investigations by the HHS Office for Civil Rights and multiple class-action lawsuits, highlighting the high-value nature of healthcare administration datasets for identity fraud.