TLDR Tech / InfoSec
Defending SaaS-based applications against ShinyHunters OAuth abuse
Between mid‑2025 and mid‑2026, ShinyHunters used vishing and supply‑chain attacks to gain OAuth‑based access to Salesforce environments, posing as IT staff or abusing compromised integrations like Salesloft, Gainsight, and Klue to run high‑volume API queries and exfiltrate CRM data while blending in with normal traffic. Microsoft and Salesforce expanded telemetry and real‑time monitoring, added risk‑scored visibility into connected apps, and published hunting queries and Defender detections so teams can spot suspicious OAuth activity, over‑privileged or unused apps, and large report exports tied to specific identities and infrastructure.
Read the full story