-
-
Google has issued an urgent alert to its 2.5 billion Gmail and Cloud users, warning of a new wave of cyberattacks linked to the notorious hacking group.
A high-profile hacker group, ShinyHunters, known for previous high-profile breaches involving Microsoft, Santander, and Ticketmaster, has resurfaced with an advanced campaign targeting corporate networks globally.
According to Google’s Threat Analysis Group (TAG), ShinyHunters are now leveraging stolen credentials – many from recent Salesforce-related data breaches – and combining them with advanced social engineering tactics.
The hackers impersonate IT staff over phone calls, tricking employees into giving up passwords or clicking on links that contain a virus.
Once inside, attackers gain access to sensitive business data, which they then use as leverage for alleged blackmail and extortion. Victims are threatened with the public release of confidential information unless ransom demands are met.
READ: Google launches AI Mode in 180 countries including Pakistan
Emerging in 2020, the ShinyHunters group has built a reputation for massive data leaks. While their earlier operations focused on selling stolen information on dark web forums, Google warns that the group is evolving.
TAG reports that the hackers are now planning to launch a dedicated data leak site (DLS) to intensify extortion tactics and maximize pressure on victims.
This shift marks a troubling trend: formerly routine data breaches are now being weaponized for broader disruption.
Although Google confirms that its own systems remain uncompromised, it acknowledges the scale of the threat posed to its vast user base.
The company began notifying potentially affected users via email on August 8 and has urged all Gmail and Google Cloud customers to strengthen their cybersecurity measures. Recommended steps include:
- Enabling two-factor authentication (2FA)
- Regularly updating passwords
Remaining vigilant against suspicious emails or phone calls, especially those from individuals posing as IT support
Google also highlighted that the current wave of attacks appears to be heavily focused on English-speaking divisions of multinational corporations, where impersonation tactics are proving especially effective.
