Microsoft maps three OAuth‑based Salesforce intrusion paths used by ShinyHunters
Microsoft’s research shows ShinyHunters‑linked actors have spent a year breaching Salesforce tenants by abusing trusted OAuth relationships rather than exploiting any software flaw. The campaigns rely on voice‑phishing‑driven consent abuse, compromised SaaS supply‑chain integrations, and mis‑configured Experience Cloud guest access, giving attackers persistent read access to CRM data across many industries.