Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths

Microsoft researchers have uncovered a sophisticated year-long campaign targeting corporate Salesforce environments, with indicators pointing to the notorious data-extortion group ShinyHunters. What makes this attack particularly concerning is that the perpetrators gained access not by exploiting vulnerabilities in the Salesforce platform itself, but by leveraging the trust relationships organizations had already established with third-party applications.

The attack campaign, which has been active for approximately twelve months, focused on infiltrating Salesforce environments through OAuth connections that integrate the platform with various external applications and vendor services. Unlike traditional attacks that exploit technical flaws, this campaign capitalized on the inherent trust in these established connections, allowing attackers to move laterally across connected systems and exfiltrate sensitive data undetected.

Organizations utilizing Salesforce with extensive third-party integrations appear to be the primary targets. The attackers systematically exploited these OAuth connections, which many companies implement without comprehensive security oversight. This method of infiltration represents a significant shift in attack tactics, focusing on the trust chain between enterprise systems rather than platform-specific vulnerabilities.

This discovery matters because Salesforce