Threat Intelligence Brief
Curated summary with source attribution
Source: microsoft.com
Threat Risk: High
Victim: Salesforce customers in retail, education, and manufacturing
Incident: Abuse of OAuth trust relationships to gain unauthorized access to Salesforce tenants.
Impact: Large-scale exfiltration of sensitive CRM records and persistent unauthorized access to SaaS environments.
Attacker: ShinyHunters
Analysis: Attackers leverage vishing and supply chain compromises to trick users into authorizing malicious OAuth applications. Once granted, these apps provide persistent API access to enumerate and exfiltrate sensitive CRM data. This approach bypasses conventional authentication detections by operating within legitimate, trusted workflows.
Recommendations: Audit all OAuth-connected applications and revoke unnecessary permissions; Implement strict monitoring and validation for guest access configurations; Educate employees on vishing attempts that target OAuth consent flows
Source: Microsoft Security Blog
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source