ShinyHunters Campaigns Targeting SaaS and Salesforce OAuth

Between mid-2025 and mid-2026, Microsoft and other researchers identified extensive campaigns by the ShinyHunters threat group and related clusters (including Scattered Spider and Storm-3138) targeting Salesforce and other cloud-based CRM environments. The primary intrusion vectors involve sophisticated voice phishing (vishing) to trick employees into authorizing malicious OAuth applications and the compromise of third-party SaaS integrations like Salesloft/Drift and Gainsight to gain downstream access to customer instances.

Once access is achieved, attackers exfiltrate large-scale CRM records, including account and contact details, and then move to a 'pay or leak' extortion model. These campaigns represent a significant shift toward identity-centric and supply-chain-driven attacks that bypass traditional authentication-focused detections by operating through trusted OAuth relationships and legitimate application permissions. The financial and reputational impact has affected multiple global sectors, with some breaches resulting in billions of exposed records.