SUBJECT PROFILE
On July 13, 2026, Microsoft published a major research mapping a year-long ShinyHunters campaign (mid-2025 to mid-2026) targeting Salesforce environments across more than 700 organizations via three distinct attack paths: vishing attacks impersonating IT support to gain OAuth consent for malicious apps, supply chain compromise through trusted integrations (Salesloft Drift in Aug 2025, Gainsight in Nov 2025, Klue in Jun 2026), and abuse of misconfigured Salesforce guest-user Aura endpoints. Because all activity flows through legitimate OAuth tokens and approved application identities, it appears indistinguishable from routine Salesforce API usage, evading conventional sign-in detections. The Klue incident (June 2026) cascaded to expose data from Huntress and Recorded Future via downstream Salesforce and Gong integrations.
Data theft and extortion at scale; CRM and SaaS data aggregation for resale and ransom leverage; supply chain pivot attacks against SaaS vendor ecosystems
OPERATIONAL HISTORY
Voice phishing (vishing) impersonating IT support, OAuth consent abuse (malicious Salesforce Data Loader app), SaaS supply chain vendor compromise, OAuth token reuse across downstream tenants, Salesforce Aura guest endpoint scanning, CRM data enumeration and exfiltration via legitimate API calls, persistence through long-lived application tokens, MFA bypass via OAuth workflow abuse
KNOWN INFRASTRUCTURE
Malicious Salesforce connected apps masquerading as Data Loader, compromised Salesloft Drift/Gainsight/Klue vendor credentials, attacker-controlled Salesforce OAuth app registrations, DigitalOcean-hosted C2 infrastructure