grep -rl "vishing" ./articles
McKesson's 8-K describes roughly one terabyte exfiltrated between 21 and 25 August 2026, detected on the last day. The chain was vishing to Okta SSO to Salesforce and Snowflake — no CVE, no exploit, no patch. And the claimed 284 million records are database rows, by the attackers' own account.
ShinyHunters registered a fake ReliaQuest SSO page and rang staff one by one, each time impersonating a named colleague from the security team. One person typed their password and approved the push. ReliaQuest says the attackers got view-only access to an Okta dashboard and nothing else — and the interesting part is which controls held.
UNC6671 runs four extortion brands off one set of domains. The pretext is a security upgrade — FIDO2 enrolment, MFA migration — and the payoff is an adversary-in-the-middle portal. Average settled payment: $750,000.