Defending SaaS-based applications against ShinyHunters OAuth abuse

Microsoft observed campaigns between mid-2025 and mid-2026 where actors leveraging ShinyHunters-like tradecraft abused OAuth consent (including vishing), supply-chain integrations (e.g., Salesloft, Gainsight), and misconfigured guest access to gain persistent access, enumerate CRM records, and exfiltrate data at scale across multiple industries; Microsoft worked with Salesforce to improve telemetry and detections and noted the activity was abuse of trusted relationships rather than a Salesforce vulnerability.