In October 2025, the extortion group ShinyHunters launched a darknet platform with the data of six organizations - Albertsons, Fujifilm, Gap, Qantas, Engen Resources, Vietnam Airlines - and announced the compromising about a billion records from Salesforce-instorms of 39 companies. Among the victims are Cisco, Disney, FedEx, Marriott, Baker Distributing. Salesforce has publicly refused to pay a ransom.
The most interesting thing here is what the attackers did not use. Not a single zero-day. The whole chain was built on phone calls and OAuth staff. Called, asked, got access. That's it.
Business logic of attack: why extortion-groups aimed at SaaS-platforms
Why are ShinyHunters and associated clusters (UNC6040, UNC6240, UNC6395) that are corporate SaaS? More details - in our article about protection against ransomware.
The growth of attacks on cloud infrastructure is not a Vendor horror story. According to CrowdStrike Global Threat Report 2025, the number of cloud incursions increased by 26% over the year. 75% of incidents exploited valid accounting data - not vulnerabilities, not malware, but legitimate access. IBM X-Force captures even more rigidly: +71% attacks using valid credentials year-on-year. Verizon DBIR 2025 confirms that 38% of data leaks are related to the theft of accounting data.
Salesforce stores CRM records: customer names, emails, phones, transaction history, support labels. Airlines like Qantas have passport data, employment history, loyalty programs. SharePoint - corporate documents, internal wiki, file storage. For extortion groups - the ideal goal for three reasons.
The first is the Salesforce customer base is converted into target pitching, resale on the darknet and blackmail. Baker Distributing is a distributor of HVAC equipment whose Salesforce contains data from thousands of contractors. Data leakage of this scale hits the entire supply chain.
The second is blast radius. The commification of one OAuth token through third-party integration opens access to the data of dozens and hundreds of tenants. The case of Salesloft Drift, according to Valence Security, affected more than 700 organizations in ten days. One token is seven hundred victims.
The third is the blind spot of security teams. The classic EDR and SIEM are sharpened for endpoint-telemetry. A legitimate API-call from an authorized OAuth application does not generate alerates in a standard configuration. The leak you learn of from the darknet post, not from your own SIEM, is a nightmare for any SOC.
Binding to MITRE ATT&CK: kill chain fits into specific techniques - Cloud Accounts (T1078.004, Initial Access), Customer Relationship Management Software (T1213.004, CollectionSharePoint ( ), SharePointT1213.002, Collection), Data from Cloud Storage (T1530, CollectionExfiltration to Cloud Storage (T1567.002, Exfiltration)
Kill chain ShinyHunters: four phases of Salesforce compromise
The attack, documented by Seqrite researchers, Microsoft Threat Protection and Valence Security, was based on a clear four-phase scenario.
Phase 1: Wising and Social Engineering
It all started with a phone call. The attackers - through the Mullvad VPN to disguise the outgoing - called employees of target organizations, presenting themselves as IT support. Sometimes referred to as Salesforce employees. Legend: an urgent troitut of support that requires immediate action.
Generative AI has accelerated training: according to CrowdStrike, the harmful use of GenaI for social engineering doubled in 2024. IBM X-Force notes that the generation of phishing emails using GenAI faster by 11.4 times with comparable quality. The preparation of iching scripts adapted to a specific organization and the role of the victim takes minutes instead of hours.
The purpose of the call is not a password directly (although in some cases the attackers collected credentials and MFA-codes "for verification"). The main task is to convince the employee to authorize the OAuth application.
MITRE ATT&CK: Multi-Factor Authentication Request Generation (T1621, Credential Access) - the attackers requested MFA codes under the pretext of verification. Cloud Accounts (T1078.004, Initial Access) - the received credentials were used to legitimize access.
Restrictions of technology: Wising works against organizations without a clear process of verification of incoming calls from "IT-support". Companies with out-of-band verification (callback to a well-known number, confirmation through the corporate messenger) dramatically reduce the success rate of this vector. It sounds elementary - but of the 39 victims, none of them did.
Phase 2: Connecting the malicious OAuth App
After establishing trust, the operator sent the victim to the Connected Apps page in Salesforce and asked to enter the “connection code”. This code is the registration of a malicious OAuth app, a modified version of Salesforce Data Loader.
One button of the consent - and the attackers received OAuth to refreshken with the rights to read and write CRM data. According to Microsoft Threat Protection Blog, all subsequent data requests looked like legitimate API calls from an authorized application. Standard monitoring tools did not distinguish them from normal activity.
Next - custom Python scripts emulating DataLoader operations for automated bulk export. Exfiltration began during or immediately after the call - security teams did not have time to react.
MITRE ATT&CK: Additional Cloud Roles (T1098.003, Persistence/Privilege Escalation) - OAuth refreshed token gave the persistent access without re-authentication. Until the token is withdrawn - attacking inside.
Phase 3: CRM extilting and lateral movement to SharePoint
With the OAuth token received, the attackers performed SOQL queries for mass unloading of objects:, contacts, cases, opportunities. According to TechTarget, the stolen data included names, emails, phones, dates of birth, and loyalty program data, and Qantas had passport numbers.
In parallel, the attackers used the collected credentials (Okta, Azure AD) for lateral movement: access to Office 365 and SharePoint through the Graph API, Slack-workspaces, OneDrive file storage. SharePoint compromise expanded the scale of the leak - from CRM-enterration to corporate documents.
All exfiltration went through the TOR. According to Seqrite, the weekend of the nodes were located mainly in the Netherlands and Switzerland (hosting: Macarne, Private La Yered INC). The attackers mixed TOR traffic with legitimate OAuth sessions - a standard technique for attribution difficulties.
MITRE ATT&CK: Customer Relationship Management Software (T1213.004, CollectionSharePoint ( ), SharePointT1213.002, Collection), Data from Cloud Storage (T1530, CollectionExfiltration to Cloud Storage (T1567.002, Exfiltration)
Phase 4: Exhibiting and Data Release
With the stolen data, the group moved on to extortion. Double pressure: contact with the victim (requirement of Bitcoin payment within 72 hours) plus the threat of publication on the darknet site. In some cases, the attackers have falsely stated a connection with other well-known groups to increase pressure.
Chronology of the TechTarget campaign:
• April 2024 - September 2025: a phishing campaign against Salesforce customers.
• October 3, 2025: launching a darknet site with 39 victims.
• October 7-8, 2025: Salesforce publicly refuses to negotiate and pay.
• October 10, 2025: the deadline.
• 12-13 October 2025: publication of data from six victims.
According to IBM, organizations need an average of 241 days to identify and deter leakage. Six months. During this time, IT teams are forced to restrict access, introduce additional authentication and reduce functions. For companies dependent on Salesforce (Baker Distributing - an example where CRM is critical of operating activities), such restrictions directly inhibit revenue-generating processes.
Second Wave: Supply chain compromise through Salesloft Drift
In August 2025, the second vector - UNC6395 - was manifested. There's no vyshing. The attackers compromised OAuth-tokens via Salesloft Drift - AI-chatbot integrated with Salesforce for sales automation.
The stolen tokens made it possible to comply with SOQL requests for Salesforce bases of hundreds of organizations. According to Valence Security, the attack affected more than 700 organizations from August 8 to 18, 2025. Salesloft reported that "the main target of the attackers was the theft of credentials - AWS access keys, passwords and tokens of access to Snowflake." By August 20, all active OAuth and refresh Windows Drift had been withdrawn in an emergency.
Here’s what it’s important to understand: even with the perfect protection of your own Salesforce-instanis, you are vulnerable through the OAuth integration supply chain. AI tools like Salesloft Drift are a particularly valuable goal, because design require a wide range of production-data. They are created to read your CRM continuously. Compromise such a tool and you get the same.
The attackers massively requested CRM data through publicly available sites where guest-users had excessive rights. The configuration error turned into a replayable breach vector without authentication. No credentials at all.
Salesforce and SharePoint Compromise Detecting in SOC
Adjustments to the environment
Before configure the monitoring, check:
• Salesforce: Enterprise license with Event Monitoring (Shield or paid addon) API-access for audit Connected Apps. Without Event Monitoring, only the basic Setup Audit Trail is available - for the OAuth-abuse detect it is not enough.
• Microsoft 365: Microsoft Defender for Cloud Apps (MCAS) with a connected Salesforce connector, or Microsoft Sentinel with data connector. License: E5 Security or Defender for Cloud Apps standalone (~$3,50/user/month).
• SIEM: KQL requests below - for Microsoft Sentinel. For Splunk/Elastic, you will need to adapt logic to the appropriate data schemes.
• Access: Security Reader in Azure AD, Salesforce administrator for auditing Connected Apps and token feedback.
Audit of OAuth-applications in Salesforce
The first action is the revision of Connected Apps. Go to Setup -> Connected Apps OAuth Usage and look for:
1. Apps with "Unknown" or non-standard name ("My Ticket Portal", "Data Loader" from an unknown publisher).
2. Applications authorized in non-working hours or with atypical IP.
3. Applications with rights read/writeobjects Account, Contact, Case, Opportunity.
4. Unexplained peaks of API calls in the last 90 days.
To automate the audit through Salesforce API:
SQL:
SELECT Id, Name, CreatedDate, CreatedById, LastModifiedDate
FROM ConnectedApplication
WHERE CreatedDate = LAST_N_DAYS:90
ORDER BY CreatedDate DESC
Any application not agreed with the IT department requires an immediate investigation and withdrawal of tokens through Setup -> Connected Apps -> Revoke.
KQL requests for Microsoft Sentinel and Defender for Cloud Apps
After connecting Salesforce to Defender (Settings -> Cloud Apps -> App connectors with Event Monitoring - according to Microsoft documentation) is available to industry. Request for detection of abnormal bulk operations:
Code:
CloudAppEvents
| where ActionType has_any ("DataExport", "QueryAll", "Query")
| where Application == "Salesforce"
| summarize TotalRecords = sum(tolong(RawEventData.rows_processed)),
OpCount = count() by AccountDisplayName, IPAddress, bin(Timestamp, 1h)
| where TotalRecords > 10000 or OpCount > 50
| sort by TotalRecords desc
Thresholds (10000 records, 50 operations per hour) - the starting point. Calibrate under your baseline activity, otherwise drown in false positives or skip real unloading. For SharePoint compromise monitor mass downloads through OfficeActivity: operations FileDownloaded and FileSyncDownloadedFull with the group by UserId and ClientIP in the watchroom. Anomaly - more than 100 files per hour from one account.
To correlate with TOR - map IP addresses from alerates with ThreatIntelligence Indicator to Sentinel or public lists exitTOR nodes. According to Seqrite, the attackers used the weekend of the ACN on ASN associated with the Macarne (Netherlands) and Private Layer INC (Switzerland).
DLP for SaaS platforms: Salesforce offers native Data Loss Prevention via Shield; in Microsoft 365, use DLP policy in Security & Compliance Center for a mass unloading detect via SharePoint and OneDrive. Defender for Cloud Apps adds a CASB layer that aggregates alerates from both platforms to a single incident view.
The most interesting thing here is what the attackers did not use. Not a single zero-day. The whole chain was built on phone calls and OAuth staff. Called, asked, got access. That's it.
Business logic of attack: why extortion-groups aimed at SaaS-platforms
Why are ShinyHunters and associated clusters (UNC6040, UNC6240, UNC6395) that are corporate SaaS? More details - in our article about protection against ransomware.
The growth of attacks on cloud infrastructure is not a Vendor horror story. According to CrowdStrike Global Threat Report 2025, the number of cloud incursions increased by 26% over the year. 75% of incidents exploited valid accounting data - not vulnerabilities, not malware, but legitimate access. IBM X-Force captures even more rigidly: +71% attacks using valid credentials year-on-year. Verizon DBIR 2025 confirms that 38% of data leaks are related to the theft of accounting data.
Salesforce stores CRM records: customer names, emails, phones, transaction history, support labels. Airlines like Qantas have passport data, employment history, loyalty programs. SharePoint - corporate documents, internal wiki, file storage. For extortion groups - the ideal goal for three reasons.
The first is the Salesforce customer base is converted into target pitching, resale on the darknet and blackmail. Baker Distributing is a distributor of HVAC equipment whose Salesforce contains data from thousands of contractors. Data leakage of this scale hits the entire supply chain.
The second is blast radius. The commification of one OAuth token through third-party integration opens access to the data of dozens and hundreds of tenants. The case of Salesloft Drift, according to Valence Security, affected more than 700 organizations in ten days. One token is seven hundred victims.
The third is the blind spot of security teams. The classic EDR and SIEM are sharpened for endpoint-telemetry. A legitimate API-call from an authorized OAuth application does not generate alerates in a standard configuration. The leak you learn of from the darknet post, not from your own SIEM, is a nightmare for any SOC.
Binding to MITRE ATT&CK: kill chain fits into specific techniques - Cloud Accounts (T1078.004, Initial Access), Customer Relationship Management Software (T1213.004, CollectionSharePoint ( ), SharePointT1213.002, Collection), Data from Cloud Storage (T1530, CollectionExfiltration to Cloud Storage (T1567.002, Exfiltration)
Kill chain ShinyHunters: four phases of Salesforce compromise
The attack, documented by Seqrite researchers, Microsoft Threat Protection and Valence Security, was based on a clear four-phase scenario.
Phase 1: Wising and Social Engineering
It all started with a phone call. The attackers - through the Mullvad VPN to disguise the outgoing - called employees of target organizations, presenting themselves as IT support. Sometimes referred to as Salesforce employees. Legend: an urgent troitut of support that requires immediate action.
Generative AI has accelerated training: according to CrowdStrike, the harmful use of GenaI for social engineering doubled in 2024. IBM X-Force notes that the generation of phishing emails using GenAI faster by 11.4 times with comparable quality. The preparation of iching scripts adapted to a specific organization and the role of the victim takes minutes instead of hours.
The purpose of the call is not a password directly (although in some cases the attackers collected credentials and MFA-codes "for verification"). The main task is to convince the employee to authorize the OAuth application.
MITRE ATT&CK: Multi-Factor Authentication Request Generation (T1621, Credential Access) - the attackers requested MFA codes under the pretext of verification. Cloud Accounts (T1078.004, Initial Access) - the received credentials were used to legitimize access.
Restrictions of technology: Wising works against organizations without a clear process of verification of incoming calls from "IT-support". Companies with out-of-band verification (callback to a well-known number, confirmation through the corporate messenger) dramatically reduce the success rate of this vector. It sounds elementary - but of the 39 victims, none of them did.
Phase 2: Connecting the malicious OAuth App
After establishing trust, the operator sent the victim to the Connected Apps page in Salesforce and asked to enter the “connection code”. This code is the registration of a malicious OAuth app, a modified version of Salesforce Data Loader.
One button of the consent - and the attackers received OAuth to refreshken with the rights to read and write CRM data. According to Microsoft Threat Protection Blog, all subsequent data requests looked like legitimate API calls from an authorized application. Standard monitoring tools did not distinguish them from normal activity.
Next - custom Python scripts emulating DataLoader operations for automated bulk export. Exfiltration began during or immediately after the call - security teams did not have time to react.
MITRE ATT&CK: Additional Cloud Roles (T1098.003, Persistence/Privilege Escalation) - OAuth refreshed token gave the persistent access without re-authentication. Until the token is withdrawn - attacking inside.
Phase 3: CRM extilting and lateral movement to SharePoint
With the OAuth token received, the attackers performed SOQL queries for mass unloading of objects:, contacts, cases, opportunities. According to TechTarget, the stolen data included names, emails, phones, dates of birth, and loyalty program data, and Qantas had passport numbers.
In parallel, the attackers used the collected credentials (Okta, Azure AD) for lateral movement: access to Office 365 and SharePoint through the Graph API, Slack-workspaces, OneDrive file storage. SharePoint compromise expanded the scale of the leak - from CRM-enterration to corporate documents.
All exfiltration went through the TOR. According to Seqrite, the weekend of the nodes were located mainly in the Netherlands and Switzerland (hosting: Macarne, Private La Yered INC). The attackers mixed TOR traffic with legitimate OAuth sessions - a standard technique for attribution difficulties.
MITRE ATT&CK: Customer Relationship Management Software (T1213.004, CollectionSharePoint ( ), SharePointT1213.002, Collection), Data from Cloud Storage (T1530, CollectionExfiltration to Cloud Storage (T1567.002, Exfiltration)
Phase 4: Exhibiting and Data Release
With the stolen data, the group moved on to extortion. Double pressure: contact with the victim (requirement of Bitcoin payment within 72 hours) plus the threat of publication on the darknet site. In some cases, the attackers have falsely stated a connection with other well-known groups to increase pressure.
Chronology of the TechTarget campaign:
• April 2024 - September 2025: a phishing campaign against Salesforce customers.
• October 3, 2025: launching a darknet site with 39 victims.
• October 7-8, 2025: Salesforce publicly refuses to negotiate and pay.
• October 10, 2025: the deadline.
• 12-13 October 2025: publication of data from six victims.
According to IBM, organizations need an average of 241 days to identify and deter leakage. Six months. During this time, IT teams are forced to restrict access, introduce additional authentication and reduce functions. For companies dependent on Salesforce (Baker Distributing - an example where CRM is critical of operating activities), such restrictions directly inhibit revenue-generating processes.
Second Wave: Supply chain compromise through Salesloft Drift
In August 2025, the second vector - UNC6395 - was manifested. There's no vyshing. The attackers compromised OAuth-tokens via Salesloft Drift - AI-chatbot integrated with Salesforce for sales automation.
The stolen tokens made it possible to comply with SOQL requests for Salesforce bases of hundreds of organizations. According to Valence Security, the attack affected more than 700 organizations from August 8 to 18, 2025. Salesloft reported that "the main target of the attackers was the theft of credentials - AWS access keys, passwords and tokens of access to Snowflake." By August 20, all active OAuth and refresh Windows Drift had been withdrawn in an emergency.
Here’s what it’s important to understand: even with the perfect protection of your own Salesforce-instanis, you are vulnerable through the OAuth integration supply chain. AI tools like Salesloft Drift are a particularly valuable goal, because design require a wide range of production-data. They are created to read your CRM continuously. Compromise such a tool and you get the same.
The attackers massively requested CRM data through publicly available sites where guest-users had excessive rights. The configuration error turned into a replayable breach vector without authentication. No credentials at all.
Salesforce and SharePoint Compromise Detecting in SOC
Adjustments to the environment
Before configure the monitoring, check:
• Salesforce: Enterprise license with Event Monitoring (Shield or paid addon) API-access for audit Connected Apps. Without Event Monitoring, only the basic Setup Audit Trail is available - for the OAuth-abuse detect it is not enough.
• Microsoft 365: Microsoft Defender for Cloud Apps (MCAS) with a connected Salesforce connector, or Microsoft Sentinel with data connector. License: E5 Security or Defender for Cloud Apps standalone (~$3,50/user/month).
• SIEM: KQL requests below - for Microsoft Sentinel. For Splunk/Elastic, you will need to adapt logic to the appropriate data schemes.
• Access: Security Reader in Azure AD, Salesforce administrator for auditing Connected Apps and token feedback.
Audit of OAuth-applications in Salesforce
The first action is the revision of Connected Apps. Go to Setup -> Connected Apps OAuth Usage and look for:
1. Apps with "Unknown" or non-standard name ("My Ticket Portal", "Data Loader" from an unknown publisher).
2. Applications authorized in non-working hours or with atypical IP.
3. Applications with rights read/writeobjects Account, Contact, Case, Opportunity.
4. Unexplained peaks of API calls in the last 90 days.
To automate the audit through Salesforce API:
SQL:
SELECT Id, Name, CreatedDate, CreatedById, LastModifiedDate
FROM ConnectedApplication
WHERE CreatedDate = LAST_N_DAYS:90
ORDER BY CreatedDate DESC
Any application not agreed with the IT department requires an immediate investigation and withdrawal of tokens through Setup -> Connected Apps -> Revoke.
KQL requests for Microsoft Sentinel and Defender for Cloud Apps
After connecting Salesforce to Defender (Settings -> Cloud Apps -> App connectors with Event Monitoring - according to Microsoft documentation) is available to industry. Request for detection of abnormal bulk operations:
Code:
CloudAppEvents
| where ActionType has_any ("DataExport", "QueryAll", "Query")
| where Application == "Salesforce"
| summarize TotalRecords = sum(tolong(RawEventData.rows_processed)),
OpCount = count() by AccountDisplayName, IPAddress, bin(Timestamp, 1h)
| where TotalRecords > 10000 or OpCount > 50
| sort by TotalRecords desc
Thresholds (10000 records, 50 operations per hour) - the starting point. Calibrate under your baseline activity, otherwise drown in false positives or skip real unloading. For SharePoint compromise monitor mass downloads through OfficeActivity: operations FileDownloaded and FileSyncDownloadedFull with the group by UserId and ClientIP in the watchroom. Anomaly - more than 100 files per hour from one account.
To correlate with TOR - map IP addresses from alerates with ThreatIntelligence Indicator to Sentinel or public lists exitTOR nodes. According to Seqrite, the attackers used the weekend of the ACN on ASN associated with the Macarne (Netherlands) and Private Layer INC (Switzerland).
DLP for SaaS platforms: Salesforce offers native Data Loss Prevention via Shield; in Microsoft 365, use DLP policy in Security & Compliance Center for a mass unloading detect via SharePoint and OneDrive. Defender for Cloud Apps adds a CASB layer that aggregates alerates from both platforms to a single incident view.
TextReceiveOnline — Next Generation SMS Receiving Platform
Faster OTP Delivery • Live SMS Tracking • Numbers From $0.08
Main Features
Real SIM-based routes
How It Works
Simple Pay-As-You-Go Pricing
Free Public Numbers Available
CREATE YOUR ACCOUNT NOW 
