ShinyHunters says it entered through phone calls, seized Okta sessions, and drained Salesforce and Snowflake data.