Microsoft Maps Three Salesforce Attack Paths Tied to a Year of Shiny Hunters Activity
Summary: Microsoft research published July 13 maps a year of Salesforce intrusions, running from mid-2025 into mid-2026, to three techniques that exploited trusted OAuth connections rather than platform flaws. The paths were vishing calls that walked employees through consenting to a fake Data Loader app, theft of OAuth tokens from third-party vendors including Salesloft Drift, Gainsight, and Klue, and unauthenticated reads of misconfigured Experience Cloud guest users via Aura endpoints.
Why it matters: Google estimated the Salesloft Drift token theft alone potentially exposed more than 700 organizations, and the ShinyHunters name claimed the Salesloft and Gainsight waves together reached close to 1,000 - a figure not independently confirmed. The controls most companies built for human logins, MFA and conditional access, do not cover the OAuth apps and integration accounts that did the actual work in every one of these paths.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026