ShinyHunters Under Pressure, Passkey-Themed Phishing Still Steals Sessions: Why Credential-Free Authentication Matters

Week of 5 October 2026 | Compiled by Team Paringa

Attackers have stopped fighting MFA and started stealing what comes after it. The question for identity leaders is what remains to steal.

What Happened This Week

🔴 ShinyHunters arrest reported, but the playbook outlives the people

BleepingComputer reports that Jordanian authorities detained Saif al-Din Khader, alias "Rey", a suspected ShinyHunters member now said to be cooperating with the FBI and "walking law enforcement through his electronic devices and digital communications". He is linked to breaches at Telefónica, Orange (Romania) and Jaguar Land Rover. A 24-year-old Dutch suspect was arrested on 15 September. The group's leak site went offline after the detention, but a new one appeared on Thursday.

The context matters. The same ecosystem claimed a September attack on FBI systems (2 to 3TB, via an alleged Oracle PeopleSoft zero-day; the FBI confirmed it was investigating unauthorised activity but not the data theft). Microsoft's September research on activity tied to ShinyHunters and related actors describes help desk impersonation, passkey, MFA and SSO-themed lures, AiTM capture of credentials and session tokens, and device-code abuse, followed by systematic exfiltration from SharePoint, OneDrive and Exchange. Targeted services included Salesforce, Google Workspace, Slack, Zendesk and Atlassian.

Arrests disrupt people, not techniques. Phishing kits and social engineering scripts are cheap to copy, so the exposure sits with any organisation where a stolen session or a persuaded help desk agent is enough to get in.

Sources: BleepingComputer | BleepingComputer (Microsoft research)

Every step in that chain depends on something that can be handed over: a password, a one-time code, a session token or a help desk reset. Credential-free authentication removes the first of those because no credential is issued to phish in the first place. It does not replace help desk process controls, so fix both. Ask your identity vendor what an attacker actually obtains after a successful lure.

🟡 Passkey-themed lures: the brand of MFA is being weaponised

The Microsoft campaign documented by BleepingComputer (published 11 September, activity seen since May) uses fake passkey and MFA enrolment pages to push victims into AiTM flows. Once a session is captured, attackers use Microsoft Graph and Node.js automation to pull files; sessions lasted about an hour and reached fewer than 1,000 files per hour. Microsoft noted the actor "invest[s] heavily in pre-attack research".

Earlier Proofpoint research (August 2025, so background rather than news) showed FIDO sign-in can be downgraded through user-agent spoofing and modified Evilginx phishlets, pushing victims to weaker fallback methods. Proofpoint stressed that passkeys themselves are not broken and saw no in-the-wild use at that time. The lesson is that fallback paths and stolen sessions, not the cryptography, are the weak points.

Sources: BleepingComputer | Proofpoint

A phishing-resistant factor is only as strong as the weakest recovery route and the session that follows it. Audit which fallback methods remain enabled in Microsoft Entra and Okta, and how quickly a stolen token is invalidated. Moving towards credential-free authentication shrinks what AiTM can capture.

🟡 Entra ID flaw: exploitation claim walked back, but the identity plane is a target

SecurityWeek reports Microsoft patched CVE-2026-69836, a critical Entra ID remote code execution issue, in September. Microsoft later clarified it had not been exploited in the wild, found the issue internally and fixed it server-side, with no customer action required.

That is a good outcome, and a fair reminder of correcting early headlines. It also shows how much trust now sits in the identity provider itself.

Sources: SecurityWeek

Cloud identity providers patch for you, which is a strength. The concentration risk is real, though: one control plane issuing tokens for everything. Review how many apps would be exposed if a single session token were replayed, and consider architectures that issue no reusable credential.

What CISOs Are Dealing With

Identity teams are being asked whether their MFA rollout has actually reduced risk. The honest answer from this month's incidents is "partly". Attackers adapt through help desk social engineering, AiTM, device-code abuse and token replay, so the metric to watch is not MFA coverage but how much an attacker can do with a stolen session.

Cost pressure adds to this. Many firms have bought premium MFA and passkey tiers and are reluctant to reopen the decision. The practical route is a gap analysis: where are fallbacks, where are long-lived tokens, and where could a credential-free approach remove the exposure entirely.

Three Things Worth Watching Next Week

1. ShinyHunters leak site activity — The new site suggests operations continue; watch for fresh victim postings.

2. FBI data theft claims — The FBI has not verified the claimed 2 to 3TB; any confirmation would change the picture.

3. Further passkey-themed lures — Expect copycat campaigns using enrolment and reset themes.

Could not verify: The Microsoft passkey-themed campaign article is dated 11 September and the Proofpoint FIDO downgrade research is from August 2025, so both are context rather than this week's news. BleepingComputer dates the Jordan detention as "Tuesday (October 1)", but 1 October 2026 is a Thursday, so the exact date was not stated here. Attribution claims about named groups come from the cited articles only. Ars Technica and industrialcyber.co were not fetched.

Questions? hello@paringa.ai

Paringa helps organisations move beyond passwords, codes and replayable sessions. Our focus is credential-free authentication that gives attackers nothing to phish. | 5 October 2026 | © Paringa Ltd