# Microsoft Exposes Year-Long Salesforce Campaign: Three Attack Paths ShinyHunters Uses to Bypass Platform Security
A year-long campaign attributed to the data-extortion group ShinyHunters has compromised Salesforce environments across retail, education, and manufacturing without exploiting a single vulnerability in the platform itself. Instead, attackers have weaponized the trust organizations place in OAuth integrations and third-party applications—leveraging legitimate connection methods to extract sensitive CRM data at scale.
In research published July 13, Microsoft identified three distinct intrusion techniques used by threat actors whose operational patterns align with ShinyHunters activity spanning mid-2025 through mid-2026. The campaigns highlight a critical blind spot in enterprise Salesforce security: most organizations lack visibility into what authenticated applications actually do once they gain access to CRM environments.
Working with Salesforce, Microsoft has released new detection and governance tooling to address this gap, but the research underscores a fundamental challenge: when attackers leverage legitimate OAuth connections and approved integrations, traditional authentication logs register the activity as routine business use.
## The Threat: Three Paths Into Salesforce
Microsoft mapped the year-long intrusion campaign to three distinct attack vectors, each exploiting different trust relationships within the Salesforce ecosystem.
Attack Path 1: Voice Phishing and Malicious Consent
The campaign began in mid-2025 when threat actors conducted voice-phishing (vishing) calls targeting employees, impersonating IT support staff. During these calls, attackers guided victims through Salesforce's OAuth consent screen, convincing them to authorize a malicious connected app masquerading as Salesforce's own Data Loader tool.
Once consent was granted, the attacker-controlled application gained the ability to:
No malware deployment was required. No password replay attacks were necessary. A single phone call and one mistaken consent click provided everything the attackers needed.
Attack Path 2: Compromised Third-Party OAuth Tokens
The second technique bypassed employees entirely. Instead of targeting individual users, threat actors compromised software vendors whose applications already held OAuth access to customer Salesforce environments. By stealing the connection secrets or refresh tokens associated with these integrations, attackers could query and export data across hundreds of downstream organizations simultaneously.
Because the traffic originated from an approved integration, it triggered no sign-in alarms and blended seamlessly into normal automation workflows.
The August 2025 compromise of Salesloft and Drift represents the clearest example of this technique. Attackers stole OAuth and refresh tokens tied to the Drift AI chat integration, then leveraged those credentials against Salesforce customer environments. Google estimated the token theft potentially exposed more than 700 organizations, including major security vendors like Cloudflare, Zscaler, Palo Alto Networks, Proofpoint, PagerDuty, and Tanium.
Attack Path 3: Misconfigured Guest Access
The third vector exploited overly permissive guest access configurations on Salesforce Customer Community and Partner Community portals. In several cases, attackers gained unauthorized access to these sites and escalated privileges to pull sensitive customer records and internal communications.
## Background and Context: A Year of Escalating Intrusions
The ShinyHunters-attributed campaign did not emerge in isolation. The group has been active in data extortion for years, but 2025 marked a significant shift in targeting and methodology.
Early Detection and Escalation
Google's Threat Intelligence Group (GTIG) and Mandiant first documented the vishing campaign in mid-2025, tracking initial access operators as UNC6040 and follow-on extortion actors as UNC6240. Both groups repeatedly claimed attribution to ShinyHunters, likely to amplify pressure on victims during extortion attempts.
In June 2025, Google confirmed that its own corporate Salesforce instance had been compromised, though attackers extracted primarily public business contact data before access was terminated.
Confirmed Victims Across Industries
Public disclosures and victim notifications have linked the campaign to breaches at:
| Organization | Industry | Attack Vector |
|---|---|---|
| Chanel | Luxury | OAuth vishing |
| Pandora | Jewelry/Retail | OAuth vishing |
| Adidas | Retail/Athletic | OAuth vishing |
| Qantas | Airlines/Travel | Unknown |
| Allianz Life | Insurance | Unknown |
| LVMH brands (multiple) | Luxury | Mixed |
| Cloudflare | Cybersecurity | Third-party token theft |
| Zscaler | Cybersecurity | Third-party token theft |
| Palo Alto Networks | Cybersecurity | Third-party token theft |
| Drift/Salesloft customers | Multiple | Third-party token theft |
The breadth of victims—spanning retail, luxury goods, insurance, telecommunications, and cybersecurity—suggests the attackers operated opportunistically across multiple vectors rather than targeting specific sectors.
## Technical Details: Why Detection Remains Elusive
The core challenge exposed by this research is architectural: Salesforce's native logging and authentication monitoring were not designed to detect anomalous behavior by authorized applications.
The Authentication Gap
Traditional Salesforce sign-in monitoring flags suspicious login attempts—impossible geographies, unusual times, high-risk IP addresses. But OAuth-approved applications bypass these controls entirely. When a connected app makes an API call on behalf of an authenticated user, it appears in audit logs as ordinary activity initiated by that user account.
Defenders monitoring authentication logs see:
Why Vishing Works Against IT Departments
The first attack path succeeded because it exploited organizational culture, not technical flaws. Help desk personnel are trained to be responsive and helpful. When someone calls claiming to troubleshoot CRM connectivity, standard security procedures—identity verification via callback to known numbers, escalation to supervisors, formal approval workflows—are often bypassed in the interest of speed.
Mandiant's analysis determined that identity checks often do not apply during these calls. Attackers, posing as internal IT staff, leveraged urgency and technical credibility to push victims through the OAuth consent screen without raising suspicion.
The Third-Party Token Problem
The Drift token theft incident crystallized a widespread architectural vulnerability: OAuth refresh tokens issued to third-party vendors can persist for months or years. If a vendor's infrastructure is compromised, attackers can use those tokens to access all downstream customer environments without needing to steal individual user credentials.
The token theft potentially affected 700+ organizations because a single compromised vendor integration provided a skeleton key to hundreds of CRM environments simultaneously.
## Implications for Organizations
This campaign reveals that Salesforce security posture depends critically on three layers most organizations have not adequately addressed:
1. Third-Party Application Risk Management – Many organizations maintain lists of approved Salesforce integrations but lack ongoing monitoring of those applications' security posture or token rotation practices.
2. User Awareness and Verification Procedures – Help desk staff and employees need training to recognize vishing attempts specifically targeting OAuth consent screens, and organizations need formal call-back verification procedures that actually work.
3. CRM Data Access Logging – Organizations often monitor *who* accesses Salesforce but rarely monitor *what* data is being extracted, at what scale, or by which applications.
The campaign demonstrates that for cloud-based SaaS platforms, the traditional perimeter is meaningless. Attackers need not be "outside" the network—they operate through legitimate, trusted connections.
## Recommendations for Defenders
Immediate Actions:
Short-Term (30-60 days):
Long-Term (60+ days):
---
## HackWire Analysis
The ShinyHunters campaign represents a maturation in data-extortion tradecraft that defenders have been slow to recognize. Prior breach campaigns typically required either stolen credentials or platform vulnerabilities. This one required neither—just social engineering and legitimate trust relationships.
The timing and scope matter. A year of unchecked access across 700+ organizations suggests that even after Google and Mandiant's mid-2025 warnings, many enterprises did not meaningfully change their Salesforce security posture. Token rotation is not exotic security theater—it's baseline practice for any OAuth environment—yet many organizations still allow third-party integrations to hold long-lived, high-privilege credentials.
What makes this campaign particularly dangerous is that it exposes a structural weakness in SaaS security that no single platform patch can fix. Salesforce cannot solve the problem of users approving malicious OAuth applications or vendors allowing their tokens to be stolen. The responsibility falls on the organizations using these platforms to implement verification procedures, monitor behavior, and rotate credentials.
The research also highlights a hidden cost of Salesforce's flexibility: the platform's rich API and extensibility, which organizations love for business reasons, becomes a liability when defenders lack visibility into what applications actually do with the access they receive. Most Salesforce logging was not built to answer the question "what data did this application export yesterday?"—which is precisely the question defenders need to answer after a breach.
— *HackWire Editorial*
---
## Related Coverage