Defending SaaS-based applications against ShinyHunters OAuth abuse

Microsoft observed campaigns between mid-2025 and mid-2026 in which threat actors linked to ShinyHunters used voice‑phishing (vishing) to trick users into approving malicious OAuth-connected apps and compromised third‑party SaaS integrations (e.g., Salesloft, Gainsight, Klue) to obtain tokens and connection secrets, enabling persistent API access and large‑scale exfiltration of Salesforce CRM data; the report outlines attack paths, MITRE techniques, detection/hunting queries for Microsoft Defender for Cloud Apps, and recommendations for governance and preventive controls.