The Quiet Heist: No Bugs, Just Broken Trust
For the past year, attackers tied to the notorious data-extortion group ShinyHunters have been pulling off a remarkably quiet heist inside Salesforce environments. Their method? It doesn’t involve a single exploit of the platform itself. No zero-days. No SQL injections.
The real vulnerability, according to new research from Microsoft, is something far more fundamental: the trust organizations place in their own OAuth connections.
These connections are the digital bridges that tie Salesforce to third-party apps, external vendors, and internal tools. And the attackers walked right over them.
Three Paths, One Goal: Steal Data, Demand Ransom
Microsoft’s threat intelligence unit mapped out three distinct intrusion paths the ShinyHunters-linked operators have used over the past year. Each path exploits a different kind of OAuth trust relationship, but the endgame is always the same — exfiltrate sensitive Salesforce data and demand a ransom.
Path 1: Compromised Third-Party App Credentials
The most common route starts outside Salesforce entirely. Attackers steal credentials for a third-party application that has an OAuth integration with the target’s Salesforce instance. Once inside that app, they use its legitimate token to access Salesforce data as if they were an authorized user.
Think of it like borrowing a friend’s badge to get into a building. You’re not breaking the lock; you’re just using someone else’s key.
Path 2: Stolen Salesforce API Tokens
In the second path, attackers go after Salesforce API tokens directly. These tokens are often stored in configuration files, shared repositories, or even plain text documents. A single leaked token can give an attacker the same access as a full-fledged admin — no password needed.
Microsoft notes that many organizations don’t rotate these tokens regularly, making them a long-lived, juicy target.
Path 3: OAuth Phishing for Consent Grants
The third path is the most social-engineered. Attackers send convincing phishing emails that trick users into granting OAuth consent to a malicious app. Once the user clicks “Allow,” the attacker’s app gets a token that can access Salesforce data on the user’s behalf.
It’s a consent trap. And it works because most users don’t read the permissions they’re granting.
Why This Matters: The Trust Blind Spot
These attacks highlight a painful truth about modern cloud security: the perimeter is dead, but many organizations still think it exists. Salesforce itself is secure. The flaws are in the ecosystem around it — the apps, the tokens, the people.
Microsoft’s report emphasizes that Salesforce data theft via OAuth abuse is not a rare edge case. It’s a growing pattern. The ShinyHunters-linked group has been at it for a year, and they show no signs of stopping.
What makes this particularly dangerous is the stealth factor. Because the attacker is using legitimate OAuth tokens, their activity often blends in with normal traffic. Security teams may not notice the exfiltration until the ransom note arrives.
What Organizations Can Do Right Now
There are concrete steps any Salesforce customer can take to reduce the risk of this kind of attack. Microsoft recommends starting with these three:
- Audit all OAuth connections — Review every third-party app with access to your Salesforce instance. Revoke anything you don’t recognize or no longer use.
- Rotate API tokens regularly — Treat tokens like passwords. Set a rotation policy and enforce it. Don’t let a token live for years.
- Train users on OAuth phishing — Teach employees to recognize consent-granting phishing attempts. A simple “Did you just approve a new app?” workflow can catch many attacks early.
For more on securing cloud platforms, check out our guide on Salesforce security best practices and learn how to prevent OAuth token abuse in your organization.
The Bigger Picture: Cloud Trust Is a Double-Edged Sword
This isn’t a Salesforce problem. It’s a cloud ecosystem problem. Every major platform — from AWS to Google Workspace — relies on OAuth trust chains. And every one of them is vulnerable to the same kind of abuse.
The ShinyHunters-linked campaign is a wake-up call. Not because the attackers are particularly sophisticated, but because they’re exploiting something so basic: the trust we extend to the apps and people around our core platforms.
That trust is essential for modern business. But without proper oversight, it’s also the easiest door to leave unlocked.
