ShinyHunters Expands With AI-Powered Vishing, Supply Chain Intrusions, and Insider Recruitment

ShinyHunters, one of the most notorious financially motivated eCrime groups, is broadening its arsenal with AI-driven social engineering, supply chain compromises, and insider recruitment, according to new research from EclecticIQ. Analysts warn that ShinyHunters is expanding its operations by combining AI-enabled voice phishing, supply chain compromises, and leveraging malicious insiders who can provide direct access to enterprise networks.

The group has been observed outsourcing vishing operations to affiliates and is very likely relying on members of Scattered Spider and The Com to conduct voice phishing attacks that provide unauthorized access to single sign-on platforms used by retail, airline, and telecom companies.

Once attackers gain footholds through vishing and SSO compromises, stolen data is monetized at scale, with ShinyHunters’ leader, ShinyCorp, actively selling stolen datasets with ransomware affiliates and other eCrime actors at prices exceeding $1M per company. EclecticIQ notes the development of a ransomware-as-a-service network, ‘shinysp1d3r’, designed to encrypt VMware ESXi environments.

The group is also targeting high privilege engineering accounts on Git, BrowserStack, JFrog, and cloud project management platforms to infiltrate CI/CD pipelines.