CuraSec

tag: Saas-Security · 2 items

Act UNC6671 Vishing Campaign Targets SaaS Credentials at Financial Firms
2026-08-09 · The Hacker News · source ↗ #vishing#social-engineering#saas-security
  • Engineer — Learn: UNC6671 exploits human trust rather than software vulnerabilities, so there is no patch or config fix. The campaign reinforces the value of phishing-resistant (FIDO2) MFA on SaaS to limit what a tricked employee can surrender.
  • SOC/IR — Plan: Named actor with defined TTPs (IT help-desk impersonation via personal phone → SaaS credential handover) but no IOCs published yet; build or tune detections for anomalous SaaS logins and new device enrollments, and consider hunting for suspicious authentication spikes in M365 or Google Workspace logs correlated with help-desk ticket activity.
  • Leader — Act: An active data extortion group is deliberately targeting employees at financial services, private equity, and professional services firms by phone; if your org is in those sectors, brief employees this week on the IT impersonation lure and verify that help-desk identity-verification procedures are documented and enforced.
Act archived ShinyHunters targets SaaS via OAuth abuse, vishing, and guest-access misconfig
2026-07-14 · Microsoft Security Blog · source ↗ #oauth-abuse#saas-security#threat-actor
  • Engineer — Plan: ShinyHunters’ TTPs — OAuth app abuse and misconfigured guest access — directly affect cloud/SaaS configurations engineers own; no KEV or exploitation signals, but audit third-party OAuth app consent grants and tighten guest-access policies in your M365/IdP tenant this quarter.
  • SOC/IR — Act: Microsoft Threat Intelligence documents an active, named campaign; review the blog for IOCs and ATT&CK-mappable TTPs, then hunt for anomalous OAuth token grants and vishing-preceded MFA/auth events in identity logs since the publication date.
  • Leader — Plan: ShinyHunters’ supply-chain and OAuth abuse pattern against SaaS platforms warrants a SaaS vendor review this quarter — confirm key vendors enforce OAuth app allowlisting and have disabled unnecessary guest access — no specific named-vendor breach requiring immediate stakeholder communication.