Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity

Microsoft documents a year-long pattern of ShinyHunters-aligned data-extortion activity against Salesforce tenants, showing three main intrusion paths—phished/stolen credentials (including session-token phishing and infostealer logs), abuse of Connected Apps/OAuth tokens, and public Experience Cloud misconfigurations that expose data without credentials—and describes persistent, low-and-slow bulk data exfiltration and account persistence techniques, with concrete hardening and monitoring recommendations for Salesforce administrators.