Cybercrime Groups Using Vishing and SSO Abuse in Rapid SaaS Extortion Attacks

title: AHackaday IOC starter detection id: ahackaday-2026-05-01-cybercrime-groups-using-vishing-and-sso-abuse-in-rapid-saas-extortion-attacks-89bcf97e description: IOC starter rule for Cybercrime Groups Using Vishing and SSO Abuse in Rapid SaaS Extortion Attacks status: experimental author: ahackaday logsource: product: network detection: selection_iocs: - "https://thehackernews.com/2026/05/cybercrime-groups-using-vishing-and-sso.html" - "thehackernews.com" - "cybercrime-groups-using-vishing-and-sso.html" condition: selection_iocs falsepositives: - unknown level: medium

rule ahackaday_2026_05_01_cybercrime_groups_using_vishing_and_sso_abuse_in_rapid_saas_extortion_attacks_89bcf97e { meta: description = "IOC starter for Cybercrime Groups Using Vishing and SSO Abuse in Rapid SaaS Extortion Attacks" author = "ahackaday" strings: $ioc1 = "https://thehackernews.com/2026/05/cybercrime-groups-using-vishing-and-sso.html" nocase $ioc2 = "thehackernews.com" nocase $ioc3 = "cybercrime-groups-using-vishing-and-sso.html" nocase condition: any of them }