ShinyHunters PeopleSoft sshpass credential spray targeting psoft/oracle/linuxadm

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects the use of sshpass to perform credential spraying against specific PeopleSoft-related service accounts (psoft, oracle, linuxadm). The rule triggers when sshpass is executed with disabled host key checking or batch mode, indicating automated, non-interactive authentication attempts.