Act
archived
Microsoft Maps Three Salesforce OAuth Attack Paths Used by ShinyHunters
- Engineer — Plan: No platform CVE to patch — the attack surface is over-trusted OAuth connections and third-party integrations. Audit all connected apps in your Salesforce org, revoke unused OAuth grants, and review third-party vendor permissions this quarter.
- SOC/IR — Act: Microsoft has detailed three concrete attack paths from an active, year-long campaign — hunt for anomalous OAuth authorization events and unusual connected-app activity in Salesforce audit logs going back at least 12 months to check for prior compromise.
- Leader — Act: ShinyHunters is an active data-extortion group and this campaign abuses third-party SaaS trust, not software flaws — confirm your organization’s Salesforce OAuth integrations are inventoried, brief leadership on third-party SaaS risk exposure, and ask your Salesforce-connected vendors for attestation of their OAuth hygiene.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.