Treat any urgent or unusual message claiming to be from ShinyHunters, your employer’s IT team, or another organization as untrusted until you verify it through a separate channel you already know is legitimate. Don’t click its links, open unexpected attachments, share passwords or MFA codes, approve unfamiliar app access, pay, or reply to an extortion demand. Preserve the message, report it to your organization or platform, and report suspected ShinyHunters intrusions to the FBI’s Internet Crime Complaint Center (IC3) or a local FBI field office.
How to recognize a ShinyHunters phishing attempt
ShinyHunters-associated contact can arrive by email, text message, or phone call. The FBI warns that extortionists may make threats involving compromising photographs or videos; the threat alone does not prove that the claimed material exists. Information accessed in an incident may also be used to impersonate school faculty, IT support, or financial-aid staff. A sender’s claimed identity—or knowledge of personal details—is not proof that the contact is genuine. FBI public service announcement, May 15, 2026
As an Amazon Associate I earn from qualifying purchases.
Watch for pressure and requests to reveal or approve access
- Immediate deadlines, threats, or demands for payment.
- A new or unfamiliar sender, a lookalike address or domain, or contact details that do not match the organization’s usual channels.
- Links to sign in, unexpected attachments, or requests to verify personal information.
- Requests for your password or MFA code, or a prompt to approve a sign-in or application you did not initiate.
A polished message can still be fraudulent. Attackers may have enough real-world context to make a message sound convincing, so judge it by how the request can be independently verified—not by how personalized it appears. The FBI and Microsoft provide guidance on recognizing suspicious contact and reporting phishing: FBI and Microsoft.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Be especially cautious of IT calls and app-authorization requests
Google Threat Intelligence Group and Mandiant describe callers impersonating company IT staff, claiming to update MFA settings, and directing employees to company-branded sites that steal single sign-on credentials and MFA codes. Some observed domains resembled a company name followed by “sso.com” or “internal.com.” Those are examples from reported activity, not a complete list of malicious domains; a familiar-looking name does not establish that a site is safe. The actors sometimes enrolled their own devices for MFA after stealing credentials. Google Cloud threat-intelligence report, January 30, 2026
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft also describes voice-phishing campaigns that persuaded users to authorize attacker-controlled OAuth applications in Salesforce environments, including apps disguised as legitimate Data Loader tools. A real vendor’s branding or a familiar-looking workflow does not prove that a caller or permission request is trustworthy. Microsoft, July 13, 2026
What to do if you receive a suspicious message
- Stop and verify independently. Don’t use the link, phone number, or reply address in the message. Visit the organization’s official site by entering its address yourself, or contact it using a number or channel you already trust. The FBI advises verifying urgent or unusual requests through another communication method. FBI guidance
- Don’t provide credentials or approve access. Never enter a password or MFA code on a page reached through an unsolicited prompt. Decline an unfamiliar sign-in or app-authorization request. OAuth consent can give an application access to account data; changing a password may not revoke an access token granted to an app. FBI consent-phishing guidance, September 1, 2026
- If you shared a password or code, contact the provider or your organization’s security team promptly. Change the affected password and any other account passwords that reuse it. Review recent sign-ins and enrolled MFA devices, and ask the provider or security team to help secure the account. The FBI recommends contacting account providers to regain control and change passwords. FBI guidance
- If you approved an unfamiliar app, revoke its access. Use the account’s security or connected-app settings to remove the application, and notify your organization’s security team if this is a work or school account. The FBI warns that a consent-granted token can remain usable after a password change, so changing the password alone may not end the app’s access. FBI consent-phishing guidance
- Keep evidence without revisiting suspicious links. Save the message and record its sender address or number, any URLs shown in it, the date and time, the account or platform involved, and what you did. Screenshots can help; do not open the links to collect more information.
- Report the attempt. Use your employer’s, school’s, or provider’s security-reporting process and the platform’s built-in phishing-report option where available. For suspected ShinyHunters intrusions, also report to IC3 or a local FBI field office.
Where to report ShinyHunters phishing
Your email, collaboration platform, employer, or school
Report the message using the built-in phishing feature if your email or collaboration platform offers one. If the message concerns a work or school account, follow the organization’s incident-reporting process as well. Microsoft’s support instructions cover reporting phishing in Outlook and Teams; if you use another mail client, Microsoft recommends sending the original email as an attachment to its reporting address. Platform procedures can differ, so follow the current instructions for the service you use. Microsoft: Report phishing and suspicious emails
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The FBI’s Internet Crime Complaint Center or a field office
The FBI encourages people to report suspected ShinyHunters intrusions to IC3 or a local FBI field office. Include the details you have, such as dates and times, communications, account or organization involved, and screenshots. For an immediate, life-threatening emergency, call 911. The FBI advises not paying or responding to extortion demands. FBI public service announcement
Reduce the risk of a repeat attempt
For work or school accounts, ask your security team whether phishing-resistant MFA is available. Google Threat Intelligence identifies FIDO2 security keys and passkeys as examples. They can help defend against credential-harvesting tactics, but no MFA method guarantees protection from every form of social engineering. Google Cloud threat-intelligence report
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Observed tactics can change, and whether a particular person’s information was exposed depends on the organization and incident. Rely on formal notices from your employer, school, or service provider for information about your own account. The FBI’s and Google’s reports describe activity observed at the dates of publication; they do not establish that every ShinyHunters-related incident uses the same methods.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
