ShinyHunters use tactics including stolen credentials, compromised OAuth tokens, social engineering, vishing, and abuse of legitimate access privileges.