Defending SaaS-based applications against ShinyHunters OAuth abuse

1. Executive summary

Between mid-2025 and mid-2026, Microsoft tracked a series of campaigns targeting customer SaaS-based applications — predominantly Salesforce instances — using tradecraft associated with the actor "ShinyHunters". Attribution to ShinyHunters is unconfirmed (no MITRE ATT&CK profile exists for this actor in verified reference data). The activity does not exploit a software vulnerability in Salesforce; rather, actors abuse trusted OAuth relationships and misconfigured guest access to achieve persistent API access, enumerate CRM records, and exfiltrate data at scale. EMEA financial services organisations heavily reliant on Salesforce and third-party SaaS integrations (e.g., Salesloft, Gainsight) face a high risk of silent data exfiltration through legitimate, trusted workflows that evade conventional authentication detections.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: Microsoft attributes the tradecraft to "ShinyHunters" and identifies a separate actor, "Storm-3138", in the Klue incident. Neither actor has a MITRE ATT&CK profile in verified reference data; attribution is unconfirmed and rests solely on Microsoft's reporting (single-sourced; verify before enforcement).

Attack chain — three confirmed intrusion paths

Path 1: Vishing-driven OAuth consent abuse (mid-2025 onwards)

1. Threat actors conducted vishing attacks impersonating IT support personnel.
2. Users were socially engineered into authorising attacker-controlled connected apps within their Salesforce tenant.
3. Actors guided users through the OAuth consent workflow to grant access to a malicious application disguised as a legitimate Salesforce Data Loader tool.
4. Once consent was granted, the highly privileged OAuth application enabled actors to perform API calls on behalf of the victim user, facilitating: - Enumeration of Salesforce instances belonging to targeted organisations. - Persistent access to Salesforce CRM data. - Possible lateral movement into other SaaS platforms through discovered credentials.
5. Data exfiltration occurred through sanctioned application access inherited from user privileges — no malware or credential replay required.

Path 2: SaaS supply-chain compromise (August–November 2025, June 2026)

1. August 2025: Compromised Salesloft Drift credentials enabled attackers to obtain connection secrets used by downstream SaaS applications. Attackers used OAuth tokens to access multiple customer Salesforce instances.
2. November 2025: Attackers targeted Gainsight-published applications integrated with Salesforce, leveraging trusted external connections to maintain persistent API access in multiple Salesforce customer instances. Activity appeared indistinguishable from legitimate integration behaviour.
3. Actors performed discovery, bulk data queries, and mass exfiltration of sensitive CRM records — including accounts, contacts, and service case data — without generating traditional sign-in anomalies.
4. June 2026: Market intelligence platform Klue experienced an incident where actor "Storm-3138" gained access. Credentials used to access Salesforce customer instances were used to discover, query, and exfiltrate data. The IP address 138.226.246.94 was used by the Klue integration to call the Salesforce API to perform CRM queries on June 11 (previously disclosed by Klue).

Path 3: Misconfigured guest access (June 2026)

1. Threat actors leveraged unauthenticated access to Salesforce Aura framework functionality.
2. Actors used GraphQL-based Aura requests to systematically query and retrieve data.
3. By chaining Aura requests and leveraging GraphQL queries, actors circumvented standard record-retrieval limitations and extracted significantly larger volumes of data than would typically be accessible to guest users.
4. This exploited misconfigured guest-user permissions — not a software vulnerability.
5. IP addresses 103.75.11.78 and 103.75.11.110 were used to target the Aura framework with guest access from June 19 to 22. These were not previously published and were discovered by Microsoft as part of a novel campaign.

Key technical characteristics across all paths

• All three intrusion paths relied on inheriting trusted application or user privileges, making malicious activity difficult to distinguish from normal operations.
• Traditional authentication-focused detections provided limited visibility; no sign-in anomalies were generated.
• Persistence was achieved through OAuth token validity and trusted integration connections rather than malware or backdoors.
• Exfiltration was conducted via legitimate API calls, report exports, and scraping patterns.

4. Mitigation & containment

P1 — Within 24 hours

• Audit all Salesforce connected apps: Review every OAuth-connected application in your Salesforce instance. Identify apps with elevated scopes or administrative permissions. Revoke access for any unrecognised or unnecessary applications, particularly any disguised as "Salesforce Data Loader" or similar utility tools.
• Block known malicious infrastructure: Add the following IP addresses to firewall and SaaS CASB blocklists:
• 138.226.246.94, 212.86.125.24, 213.111.148.90, 94.154.32.160, 103.75.11.78, 103.75.11.110
• Review guest-user configurations: Audit all Salesforce guest-user permissions. Restrict guest-user access to Aura framework endpoints. Disable guest-user access to sensitive objects where business requirements do not mandate it.
• Review third-party integration credentials: If your organisation uses Salesloft/Drift, Gainsight, or Klue integrations with Salesforce, rotate all connection secrets and OAuth tokens immediately. Review access logs for these integrations for anomalous API activity since August 2025.

P2 — Within 72 hours

• Enable Salesforce Shield: Event Monitoring: If not already enabled, activate Salesforce Shield Event Monitoring (and Real-Time Event Monitoring / RTEM where available) to capture granular API event data, connected app attribution, and application permission insights.
• Hunt for compromise using Microsoft Defender for Cloud Apps: If provisioned, run the following KQL queries in Advanced Hunting (set time range to Last 30 days):
• Hunt for connected-app activity from suspicious infrastructure (filter on ApiTotalUsage and API Event actions where array_length(UncommonForUser) > 0).
• Hunt for anomalous report exports (ActionType == "ReportExport").
• Audit query objects accessed by users (ActionType == "UniqueQuery", extract target object from QUERY_IDENTIFIER).
• Hunt for users with Defender risk score ≥ 90 signing into Salesforce via SSO.
• Review Salesforce Aura endpoint exposure: Confirm that Aura framework endpoints are not accessible to unauthenticated users. Validate GraphQL query depth and complexity limits.
• Identify inactive connected apps: Review all connected apps inactive for 90+ days and revoke access where no business justification exists.

P3 — Within 7 days

• Implement OAuth governance policy: Establish a formal review cycle for all Salesforce connected apps. Use Microsoft Defender's risk scoring model (0–100) to prioritise apps for review. Create custom policies based on risk thresholds to trigger alerts and actions.
• Strengthen vishing awareness controls: Given the confirmed social engineering vector (impersonation of IT support to drive OAuth consent), reinforce anti-vishing training and implement verification procedures for any OAuth consent requests initiated outside of normal provisioning workflows.
• Validate third-party vendor security: Contact SaaS integration vendors (Salesloft, Gainsight, Klue, and others) to confirm they have remediated credential exposure and rotated connection secrets. Review contractual provisions for incident notification and token security (engages DORA Art. 30).
• Deploy Defender for Cloud Apps Salesforce connector upgrade: The upgraded connector onboards the RTEM framework, providing near-real-time detection, connected application attribution, and expanded application permission insights.

5. Indicators of compromise

ipv4  138.226.246.94
ipv4  212.86.125.24
ipv4  213.111.148.90
ipv4  94.154.32.160
ipv4  103.75.11.78
ipv4  103.75.11.110

6. Detection

The source material provides KQL queries for Microsoft Defender Advanced Hunting and behavioural detection descriptions. No file-based artefacts (hashes, filenames, registry keys) are present in the sources. The following Sigma rule encodes the behavioural indicators described by Microsoft for Salesforce OAuth abuse detection.

title: Salesforce OAuth Connected App Anomalous Activity
id: 7a3c1f2e-8b9d-4e6a-9c0f-1d2e3f4a5b6c
status: experimental
description: >
  Detects anomalous activity patterns associated with ShinyHunters OAuth abuse
  campaigns against Salesforce, including suspicious connected app activity,
  anomalous API usage, report exports, and guest-user Aura framework access.
  Based on Microsoft Defender detection coverage described in the source blog.
author: Adverse Trace
date: 2026/07/14
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/13/defending-saas-based-applications-against-shinyhunters-oauth-abuse/
logsource:
  product: salesforce
  service: event_monitoring
detection:
  connected_app_new_ip:
    event_type: ApiTotalUsage
    connected_app_id: '*'
    condition: connected_app_new_ip
  anomalous_api_activity:
    event_type: API Event
    anomaly: true
    condition: anomalous_api_activity
  anomalous_report_export:
    event_type: ReportExport
    anomaly: true
    condition: anomalous_report_export
  guest_user_aura:
    event_type: '*'
    user_type: guest
    framework: AuraInspector
    condition: guest_user_aura
  guest_user_anomalous:
    event_type: '*'
    user_type: guest
    anomaly: true
    condition: guest_user_anomalous
  condition: connected_app_new_ip or anomalous_api_activity or anomalous_report_export or guest_user_aura or guest_user_anomalous
falsepositives:

  - Legitimate administrative use of connected apps from new IP addresses
  - Scheduled bulk report exports by authorised users
  - Legitimate guest-user access to public-facing Aura components
level: high

The following KQL queries are reproduced from the source for immediate use in Microsoft Defender Advanced Hunting (set time range to Last 30 days):

Hunt for Salesforce connected-app activity from suspicious infrastructure

CloudAppEvents
| where Application == "Salesforce"
| where ActionType in ("ApiTotalUsage", "API Event")
| extend ConnectedAppId = tostring(
coalesce(
RawEventData.CONNECTED_APP_ID,
RawEventData.ConnectedAppId
)
)
| where isnotempty(ConnectedAppId)
| where array_length(UncommonForUser) > 0

Hunt for anomalous report export / large data access

CloudAppEvents
| where Application == "Salesforce"
| where ActionType == "ReportExport"
| extend SalesforceUserId = tostring(RawEventData.USER_ID)
| summarize Events=count() by AccountObjectId, AccountId, AccountName, SalesforceUserId, IPAddress, UserAgent

Audit queries to verify what objects users are accessing

CloudAppEvents
| where Application == "Salesforce"
| where ActionType == "UniqueQuery"
| extend
QueryText = tostring(RawEventData.QUERY_IDENTIFIER),
QueryObject = extract(@"(?i)\bfrom\s+([^\s]+)", 1, tostring(RawEventData.QUERY_IDENTIFIER)),
SalesforceUserId = tostring(RawEventData.USER_ID)
| where QueryText != "SOQL"
| project Timestamp, AccountDisplayName, SalesforceUserId, QueryObject, QueryText

Hunt for users with very high Defender risk score signing into Salesforce

let VeryRiskyUsers = IdentityInfo
| where DefenderRiskScoreNumber >= 90
| distinct AccountObjectId
CloudAppEvents
| where Application == "Salesforce"
| where ActionType has "sso" or ActionType has "saml"
| where AccountObjectId in (VeryRiskyUsers)
| project Timestamp, AccountObjectId, AccountDisplayName, ActionType, UserAgent
| order by Timestamp desc

7. Sources

• Microsoft Security Blog — "Defending SaaS-based applications against ShinyHunters OAuth abuse" — https://www.microsoft.com/en-us/security/blog/2026/07/13/defending-saas-based-applications-against-shinyhunters-oauth-abuse/ — 2026-07-13
• The Hacker News — "Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths" — https://thehackernews.com/2026/07/microsoft-maps-year-long-shinyhunters.html — 2026-07-14

8. Adverse Trace position

This is a high-severity threat to EMEA financial services organisations using Salesforce and third-party SaaS integrations. The attack chain does not exploit a CVE or software vulnerability — it abuses trusted OAuth relationships, making it invisible to traditional authentication-based detections. The confirmed exfiltration of CRM records (accounts, contacts, service cases) at scale across multiple tenants and industries since mid-2025 demonstrates operational impact. Attribution to ShinyHunters and Storm-3138 is unconfirmed (no MITRE ATT&CK profiles; single-sourced to Microsoft). Clients should immediately audit Salesforce connected apps, block the six listed IP addresses, rotate credentials for Salesloft/Gainsight/Klue integrations, review guest-user Aura access, and enable Salesforce Shield Event Monitoring with RTEM. Adverse Trace will continue monitoring for corroboration of attribution and additional IOCs.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.