Finding and Notifying a ShinyHunters Claims Impersonation Campaign Before It Activated: 61 Domains, 48 Brands
Brief
By Adrian Cheek, Senior Cybercrime Researcher
ReliaQuest Threat Research published a short public advisory about a ShinyHunters campaign on August 17, 2026. This campaign was built on domains following a company[. ]claims pattern, and reported that the group had added legal team impersonation to its established help desk and IT pretexts. The advisory had no domains, and described a shape that left the reader to find the instances.
Over the following three weeks we enumerated that shape. The result: 61 domains impersonating 48 organizations, all registered through one registrar, none of them ever used. We notified every organization in the set through H-ISAC, FS-ISAC, RH-ISAC, IT-ISAC, ME-ISAC, A-ISAC, and MS-ISAC, most of them within hours of the domain being found. None is named here.
The registration phase has now ended.