A SaaS Analytics Company Got Breached. Its Authentication Tokens Were Used to Raid Snowflake Customers. ShinyHunters Is Already Extorting the Victims. This Is the Third Token Theft Campaign This Week.

WHAT HAPPENED

Last Friday, while parts of the world observed a bank holiday, ShinyHunters executed a coordinated data theft operation against over a dozen companies. The attack vector was not a vulnerability in any of the victim organizations' systems. It was a set of authentication tokens stolen from Anodot, an AI-driven analytics company that provides real-time anomaly detection for business and operational data. Anodot integrates directly with customer data environments, including Snowflake, Amazon S3, and Amazon Kinesis, using stored authentication tokens to pull data for analysis.

Anodot was acquired by analytics firm Glassbox in November 2025. Since Saturday morning, Anodot's status page has shown all of its connectors down across all geographic regions. BleepingComputer reported that multiple sources identified Anodot as the compromised integration partner, though Snowflake did not confirm the specific third-party by name. Neither Anodot nor Glassbox responded to press inquiries.

Snowflake confirmed detecting unusual activity affecting a small number of customer accounts tied to a specific third-party integration. The company stated that its own systems were not compromised, that affected accounts were locked down, and that customers were notified. Google's Threat Intelligence Group confirmed it is tracking the incident as part of a broader pattern of data theft campaigns targeting cloud services and enterprise integrations.

THE SHINYHUNTERS CONNECTION

ShinyHunters confirmed to BleepingComputer that they were behind the attacks. The group claimed to have stolen data from dozens of companies using Anodot's authentication tokens and hinted that they may have had access to Anodot's infrastructure for some time before executing the bulk exfiltration on Friday. They are now extorting victims with ransom demands to prevent data release.

This is not the first time ShinyHunters has targeted Snowflake customers. In 2024, the group ran a massive campaign using stolen credentials to access Snowflake environments that lacked multi-factor authentication. That operation hit AT&T, Ticketmaster, Santander, Neiman Marcus, and others. The current campaign is a tactical evolution. Instead of stealing individual credentials, they compromised a single integration provider and used its authorized access to reach multiple downstream targets simultaneously.

ShinyHunters also attempted to use the stolen tokens to access Salesforce environments but was blocked by automated AI detection before they could exfiltrate data. This tracks with a broader pattern we have been documenting. In our April 2 coverage of the Cisco breach, ShinyHunters was extorting Cisco with 300 stolen repositories, 3 million Salesforce records, and government data obtained through the TeamPCP supply chain. The group continues to operate at scale across multiple parallel campaigns.

ATTACK CHAIN

THE TOKEN THEFT PATTERN

This is the third distinct token theft campaign we have covered in four days. On Sunday, we analyzed the 37x surge in device code phishing, where eleven PhaaS kits sell the ability to trick users into completing MFA and handing over OAuth tokens through Microsoft's legitimate infrastructure. On Monday night, we covered APT28's FrostArmada campaign, where Russia hijacked 18,000 routers to intercept Microsoft Office tokens via DNS hijacking without deploying any malware.

Now we have a third vector: compromising a SaaS integration provider and stealing the tokens it holds for downstream customer access. Three completely different technical approaches. Three different threat actors (criminal PhaaS operators, Russian military intelligence, ShinyHunters). All converging on the same target: authentication tokens that grant access to enterprise cloud environments.

The pattern is now undeniable. Passwords are not the primary target anymore. Tokens are. And they are being harvested from every layer of the stack. From the user's browser through phishing. From the network path through DNS hijacking. From the integration layer through third-party compromise. If your security model is built around protecting passwords and enforcing MFA, you are defending against the last war. The current war is about token security, and most organizations do not even have visibility into where their tokens are stored, who holds them, or how long they live.

INCIDENT DETAILS

DEFENSE TAKEAWAYS