The landscape of corporate espionage shifted significantly as attackers realized that breaking into a perimeter is far more difficult than being invited inside by a trusted employee. Between 2025 and 2026, a series of high-profile breaches within Salesforce environments demonstrated that the most dangerous vulnerabilities are no longer found in unpatched code but in the inherent trust models governing modern identity. The ShinyHunters threat group, along with several sophisticated affiliates, orchestrated a multi-stage campaign that bypassed traditional defenses like multi-factor authentication by exploiting non-human identities and service-to-service integrations. These campaigns were not characterized by brute-force attempts but by a deep understanding of how cloud ecosystems interact. As organizations hardened their external shells, these actors focused on the invisible threads connecting applications, vendors, and users, effectively hiding their malicious activities within the noise of legitimate business operations and daily administrative tasks throughout the fiscal year.
Primary Vectors of Unauthorized Access
Social Engineering: The Human Entry Point
Sophisticated voice phishing, commonly referred to as vishing, emerged as a primary entry point for attackers seeking to manipulate employees into compromising their own secure environments. These threat actors would contact specific employees while posing as internal information technology support staff, utilizing deep-fake audio or highly researched personal details to build immediate rapport and trust. Instead of asking for a password, which might trigger a security alert, the attackers guided the unsuspecting employees through the Salesforce OAuth consent process. They presented a malicious application designed to mimic a legitimate corporate productivity tool, encouraging the user to click “Accept” on the permission screen. By leveraging the natural help desk instinct—the inclination of employees to follow technical instructions from a perceived authority figure—the attackers successfully circumvented multi-factor authentication and other biometric barriers that typically stop traditional credential theft.
OAuth Misuse: Strategic Deception
Once the initial consent was granted by the user, the attackers secured persistent API access that remained active even if the employee changed their password or logged out of their session. This access allowed the malicious actors to silently collect sensitive customer relationship management records and perform deep searches for additional credentials that could facilitate lateral movement into other cloud platforms. These specific campaigns targeted major global brands across the retail and financial sectors, proving that even organizations with highly robust security cultures and training programs remain vulnerable to well-crafted social engineering. The persistence gained through these seemingly trusted applications meant that the attackers did not need to engage in high-risk activities like credential stuffing to maintain their hold on the internal environment. This method allowed them to maintain a low profile while they systematically mapped out the data structures and extracted high-value assets over several months of operation.
Supply Chain Risks: The Vendor Link
A more advanced tactic identified during the investigation involved targeting the software supply chain by compromising the internal infrastructure of various third-party vendors. Rather than attacking a single end-user directly, threat actors focused their efforts on breaching vendors that held integrated, high-level access to many different customer Salesforce organizations simultaneously. By stealing OAuth secrets or refresh tokens from these vendor environments, the attackers were able to query and export data from hundreds of downstream instances without ever needing to interact with a human user or trigger a login notification. Specific incidents involving prominent vendors such as Salesloft, Gainsight, and Klue highlighted the massive scale of this supply chain risk in the current cloud-first era. In many cases, the attackers harvested these critical tokens from poorly secured developer environments or exploited legacy credentials that had been left active long after their initial project was completed or the developers moved on.
Over-Privileged Tokens: The Domino Effect
The widespread nature of these breaches emphasizes the significant danger posed by over-privileged integrations where a single compromise at the vendor level creates a destructive domino effect. When a third-party application is granted broad permissions to “read and write all data” across a corporate instance, any breach of that application’s own security becomes a direct breach of the customer’s data as well. This systemic vulnerability allows threat actors to bypass the security perimeters of high-profile organizations by finding the weakest link in their extended digital ecosystem. The research noted that many of these vendor integrations lacked granular permission controls, meaning that once an attacker gained the session token, they could perform any action the original application was authorized to do. This lack of isolation between different customer environments within the vendor’s own infrastructure made it possible for the ShinyHunters group to automate the data exfiltration process, targeting thousands of records.
Posture Gaps and Security Governance
Experience Cloud: Guest Access Vulnerabilities
Beyond the theft of credentials or tokens, threat actors also exploited significant misconfigurations in guest access settings on Salesforce Experience Cloud sites. By specifically targeting the Aura framework and its underlying controllers, attackers were able to bypass standard query limits and scrape massive volumes of internal data that were accidentally exposed to the public internet. This specific method of intrusion required no social engineering or stolen tokens because it relied entirely on overly permissive default settings that allowed guest users to access information they were never intended to see. Many organizations were unaware that by enabling certain site features, they were also inadvertently opening a door for anyone with a web browser to query sensitive database objects. The attackers used automated scripts to scan for these specific vulnerabilities, identifying sites where the guest user profile had been granted excessive read permissions on objects like contacts, leads, or internal document repositories.
Visibility Gaps: The Logging Challenge
The inherent difficulty in identifying these specific exploits stems from a notable lack of visibility in standard logging systems, which often fail to monitor the behaviors of authorized guest roles. While internal security teams typically watch for unusual login locations or failed password attempts, they frequently overlook the actions taken by a source that the system already considers to be a trusted entity. This significant gap in monitoring has allowed groups like Storm-3138 to operate across various critical industries, including manufacturing and higher education, with minimal interference or detection for extended periods. Without granular logging of the specific API calls made by guest users, security analysts are often left with no trail to follow after a breach has occurred. This forced organizations to realize that visibility into external-facing portals is just as vital as monitoring internal accounts, as the distinction between a guest and a malicious actor becomes blurred when permissions are managed poorly.
Proactive Monitoring: Telemetry and Analytics
In direct response to these findings, Microsoft and Salesforce collaborated to enhance monitoring capabilities, providing security teams with much better visibility into API calls and connected-app attribution. Organizations are now moving toward a more rigorous model of application governance by assigning dynamic risk scores to every integration and monitoring for over-privileged permissions in real-time. This proactive approach helps security operations centers identify applications that have access to significantly more data than they actually need to function for their specific business purpose. By implementing automated policies that flag or block integrations with high-risk scores, companies can mitigate the threat of a supply chain breach before it occurs. Furthermore, the introduction of more detailed telemetry allows for the detection of “impossible travel” patterns or unusual data access volumes by service accounts, which were previously indistinguishable from normal background activity within the complex cloud environments.
Application Hygiene: Routine Security Maintenance
Effective remediation and long-term security also require a steadfast commitment to routine hygiene, such as aggressive app pruning to revoke permissions for any inactive integrations. By moving toward a strict least privilege model and rotating integration secrets on a regular schedule, companies can significantly reduce their overall attack surface and limit the lifespan of any stolen tokens. This shift in organizational strategy acknowledges that in a modern, connected ecosystem, the trust extended to a third-party application must be continuously verified rather than blindly assumed at the point of installation. Security teams have begun to treat third-party apps with the same level of scrutiny as new employee hires, requiring regular audits and justifications for their continued access to the production environment. These efforts are complemented by the use of “canary” tokens and deceptive data points that can alert administrators the moment an unauthorized entity attempts to access a specific set of sensitive records.
Strategic Governance: Building Future Resilience
The research into these sophisticated identity-based attacks underscored the necessity of evolving beyond simple perimeter security to a model of continuous trust verification. It became clear that as attackers transitioned away from traditional exploits, organizations had to prioritize the governance of non-human identities and third-party integrations as a core component of their defense strategy. The collaboration between major cloud providers provided the necessary tools, but the ultimate responsibility for configuration and monitoring remained with the individual organizations. Moving forward, the most successful security teams implemented rigorous auditing processes that treated every connection as a potential risk. They focused on reducing the blast radius of any single compromise by strictly limiting API scopes and enforcing time-bound access for service accounts. By adopting these actionable steps, businesses transitioned from a reactive posture to one of proactive resilience, ensuring that their most sensitive corporate data remained protected.