ShinyHunters and similar groups are proving that even the most expensive security controls can be bypassed with effective social engineering. In this episode, we break down how token theft attacks work and what you can realistically do to defend against them.
- Why MFA and security investments can still fail against social engineering and session hijacking
- The techniques used by groups like ShinyHunters to steal tokens via vishing and fake login sites
- How attackers bypass Microsoft’s conditional access and move laterally through third-party SaaS apps
- The challenges of detecting token theft when traditional logging and auditing fall short
- Practical approaches to mitigate risk, including deception techniques, reviewing tenant settings, and involving offensive security testing
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer’s Links: https://spenceralessi.com