Microsoft Reveals ShinyHunters' Salesforce Attack Methods
New measures against data leaks through OAuth connections.
1OAuth Security Vulnerabilities
The ShinyHunters group infiltrated Salesforce environments without exploiting any platform vulnerabilities. Attackers abused the trust organizations extended through OAuth connections. This method was hard to detect since it involved a legitimate user approving a connected app.
2Vishing Attacks
Attackers posed as IT support over phone calls, tricking employees into approving a malicious app via Salesforce's OAuth consent screen. This granted access to user data and allowed credential hunting for other SaaS platforms.
3Token Theft
Attackers compromised third-party vendor apps to steal OAuth tokens, accessing multiple customers' Salesforce data. Since the traffic appeared as approved integrations, it bypassed sign-in alarms and blended with normal automation.
4Misconfigured Guest Access
Suspicious guest-user activity surged against Salesforce Aura endpoints. Misconfigured permissions allowed attackers to access Aura functionality without authentication, requiring no credentials.
5Microsoft's Findings
Microsoft mapped these attacks to three distinct techniques between 2025-2026. Targets included tenants in retail, education, and manufacturing sectors. New detection and governance tools were rolled out with Salesforce.
6Industry Impact
Major companies like Google, Chanel, Pandora, and Adidas were affected. Attackers accessed data from over 700 organizations via the Drift AI integration. Platforms like Gainsight and Klue also faced similar breaches.
7Defense Recommendations
Experts advise training employees against vishing calls and verifying via trusted channels. Regular OAuth token reviews and tightening guest-user permissions are also critical measures.