Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths

Attackers linked to the ShinyHunters group have been accessing corporate Salesforce environments for about a year without exploiting any vulnerabilities in the platform. Instead, they have been using the trust already established by the organization, typically through OAuth connections that link Salesforce to external apps and third-party vendors. This approach has allowed them to bypass the need for exploiting flaws in Salesforce itself. The attackers have been able to move through the environment using these existing connections. The method of attack involves leveraging the trust extended to third-party vendors and apps connected to Salesforce. The attackers have used this tactic to steal data from Salesforce environments over the past year.