# Microsoft Reveals ShinyHunters' Salesforce Attack Methods New measures against data leaks through OAuth connections. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-14 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/9ef9dc3c-84d1-4475-b810-4c23cf56dcf3 ## OAuth Security Vulnerabilities The ShinyHunters group infiltrated Salesforce environments without exploiting any platform vulnerabilities. Attackers abused the trust organizations extended through OAuth connections. This method was hard to detect since it involved a legitimate user approving a connected app. ## Vishing Attacks Attackers posed as IT support over phone calls, tricking employees into approving a malicious app via Salesforce's OAuth consent screen. This granted access to user data and allowed credential hunting for other SaaS platforms. ## Token Theft Attackers compromised third-party vendor apps to steal OAuth tokens, accessing multiple customers' Salesforce data. Since the traffic appeared as approved integrations, it bypassed sign-in alarms and blended with normal automation. ## Misconfigured Guest Access Suspicious guest-user activity surged against Salesforce Aura endpoints. Misconfigured permissions allowed attackers to access Aura functionality without authentication, requiring no credentials. ## Microsoft's Findings Microsoft mapped these attacks to three distinct techniques between 2025-2026. Targets included tenants in retail, education, and manufacturing sectors. New detection and governance tools were rolled out with Salesforce. ## Industry Impact Major companies like Google, Chanel, Pandora, and Adidas were affected. Attackers accessed data from over 700 organizations via the Drift AI integration. Platforms like Gainsight and Klue also faced similar breaches. ## Defense Recommendations Experts advise training employees against vishing calls and verifying via trusted channels. Regular OAuth token reviews and tightening guest-user permissions are also critical measures. ## Sources covering this story - https://thehackernews.com/2026/07/microsoft-maps-year-long-shinyhunters.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._