Source: The Hacker News
Author: info@thehackernews.com (The Hacker News)
URL: https://thehackernews.com/2026/07/microsoft-maps-year-long-shinyhunters.html
ONE SENTENCE SUMMARY:
Attackers abused trusted Salesforce OAuth apps, vendor tokens, and guest misconfigurations to exfiltrate data, evading login detection via “legitimate” access.
MAIN POINTS:
- ShinyHunters-aligned actors accessed Salesforce tenants without exploiting platform vulnerabilities.
- OAuth trust relationships with connected apps enabled entry and persistence.
- Microsoft documented campaigns spanning mid-2025 through mid-2026 across industries.
- Authentication logs often missed abuse because activity looked like normal approved usage.
- Vishing convinced employees to authorize attacker-controlled “Data Loader” connected apps.
- Authorized apps performed API enumeration, data export, and credential hunting across SaaS.
- Vendor compromises stole OAuth/refresh tokens, enabling multi-customer downstream access.
- Drift, Gainsight, and Klue incidents show secrets theft, token harvesting, and extortion overlap.
- Misconfigured Experience Cloud guest permissions allowed unauthenticated Aura/GraphQL data scraping.
- Microsoft and Salesforce enhanced Defender telemetry, attribution, and governance for connected apps.
TAKEAWAYS:
- Prioritize monitoring post-authentication behavior: app identity, scopes, query volume, and anomalies.
- Treat OAuth integrations as high-risk identities; enforce least-privilege scopes and token hygiene.
- Reduce third-party blast radius by auditing vendors and rapidly revoking/rotating compromised tokens.
- Lock down Experience Cloud guest roles and test Aura endpoint exposure regularly.
- Use governance to find privileged or inactive apps, then remove or re-scope them proactively.