ShinyHunters Claims FBI Breach via Oracle PeopleSoft Zero-Day
ShinyHunters Claims FBI Breach via Oracle PeopleSoft Zero-Day
ShinyHunters claims it breached FBI systems using an Oracle PeopleSoft remote code execution zero-day, stealing data on current and former agents and job applicants. Endpoint and identity teams should map the group's documented techniques, particularly help-desk social engineering, malicious OAuth applications, and stolen SaaS tokens, against current detection coverage.
On September 23, 2026, ShinyHunters publicly claimed it breached the U.S. Federal Bureau of Investigation. According to the group, the compromised systems include FBI Criminal Justice (CJ), HR, and Medlink services. A ShinyHunters spokesperson told The Register the group exploited a new Oracle PeopleSoft zero-day to achieve remote code execution, defacing the FBI jobs site (FBIjobs.gov). No CVE or technical details for this specific PeopleSoft pre-authenticated RCE zero-day have been published. The group previously weaponized a related PeopleSoft flaw, CVE-2026-35273, in June 2026 against enterprise networks. The FBI confirmed to Reuters it is aware of claims of unauthorized activity affecting FBIjobs.gov and is investigating. ShinyHunters also separately hijacked the dark web leak site of the Clop ransomware group.
The source does not confirm what data was actually exfiltrated or whether the breach claim has been verified. The claimed affected population includes current and former FBI agents and job applicants. Cato Networks VP of threat intelligence Etay Maor described ShinyHunters as targeting organizations through identity and third-party trust paths, specifically help-desk social engineering, malicious OAuth applications, and stolen SaaS integration tokens, rather than purely technical perimeter attacks. Maor described the group as a resilient criminal brand that has evolved across takedowns and arrests. The source does not state which non-FBI organizations are affected by this specific incident.
ShinyHunters posted its claim on September 23, 2026. The FBI's statement confirming awareness and investigation was shared with Reuters as of the same date. No CVE details or patch availability for the claimed PeopleSoft zero-day have been published as of the source date. The source does not give a remediation or patch timeline.
- Review your organization's Oracle PeopleSoft exposure: check whether PeopleSoft instances are internet-facing, and monitor Oracle's security advisories for any CVE addressing a pre-authenticated RCE in PeopleSoft, given the source reports no CVE is currently published for the claimed zero-day.
- Audit OAuth application registrations in your tenant: identify third-party and internal OAuth apps with broad permissions and remove or restrict those that are unused or unrecognized.
- Review SaaS integration tokens: inventory tokens used by third-party integrations and rotate any that cannot be traced to an active, authorized application.
- Check help-desk authentication procedures: verify that identity verification steps before account changes or credential resets cannot be bypassed through social engineering alone.
- Search for ShinyHunters indicators: check threat intelligence feeds for indicators of compromise associated with ShinyHunters and CVE-2026-35273 activity from June 2026.
- Monitor Oracle and CISA advisories for any published advisory or patch related to the PeopleSoft zero-day described in this incident.
My read is that the operationally significant signal here is not the FBI name, but the attack surface the source describes. If the claimed PeopleSoft vector is accurate, any organization running an internet-exposed PeopleSoft instance is potentially in scope until Oracle publishes and patches a CVE. Separately, the technique profile the source describes, OAuth abuse, SaaS token theft, and help-desk social engineering, represents a pattern that does not require a zero-day and is relevant to any organization with a federated or SaaS-heavy identity posture, regardless of whether they run PeopleSoft.
I would treat the PeopleSoft zero-day claim as unverified but worth acting on defensively now. I would not wait for a CVE before reviewing whether any PeopleSoft instances face the internet. On the identity side, I would prioritize auditing OAuth consents and SaaS tokens ahead of reviewing help-desk procedures, because the former are harder to detect after the fact.
The source is a Hacker News news article dated September 23, 2026, covering ShinyHunters' public claim and FBI acknowledgment; it does not include independent technical verification of the breach, confirmed exfiltration details, a CVE for the claimed PeopleSoft zero-day, or an official FBI investigation outcome.