ShinyHunters has resurfaced after a year-long hiatus with a highly sophisticated campaign targeting Salesforce platforms at major organizations including Google, marking a decisive shift from its historic database breaches toward advanced social engineering operations closely aligned with Scattered Spider’s methods. ReliaQuest’s analysis, supported by infrastructure forensics and forum activity under the alias “Sp1d3rhunters,” points to a possible collaboration between the two (2) groups, with operations dating back to mid-2024. The campaign spans sectors including retail, aviation, insurance, finance, and technology, leveraging coordinated phishing domains, Okta-branded credential harvesting sites, and highly targeted vishing calls impersonating IT staff to trick victims into authorizing malicious Salesforce “connected apps” disguised as legitimate tools. Over 700 phishing domains were registered in 2025 (many themed around luxury brands such as Dior and Louis Vuitton) using Cloudflare-masked infrastructure, consistent naming conventions, and VPN obfuscation to exfiltrate data. Targeting patterns have shifted since July 2025, with a 12% increase in attacks on financial services and a slight decline in technology sector focus; the U.S. remains the most affected, though UK organizations have also been hit. ReliaQuest warns that the speed, adaptability, and coordinated nature of these operations present a rapidly escalating threat, urging organizations to strengthen defences against phishing, vishing, and credential theft, enforce MFA, restrict admin permissions, monitor for suspicious domain registrations, and prepare for intensified cross-sector attacks in the coming months.