# ShinyHunters (UNC6040/UNC6395) OAuth Consent Abuse Against Salesforce and Connected SaaS Integrations

> ShinyHunters, a financially motivated data extortion group operating under Google/Mandiant designations UNC6040 (intrusion), UNC6240 (extortion), and overlapping with UNC6395 (Salesloft Drift OAuth theft), has run a sustained campaign from mid-2025 through mid-2026 abusing OAuth trust relationships to compromise Salesforce environments and connected SaaS integrations (Salesloft/Drift, Gainsight, Klue).

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1275
- **ID:** TL-2026-1275
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ShinyHunters' Salesforce-focused campaign combines voice phishing (vishing), OAuth/connected-app abuse, and SaaS supply-chain compromise to achieve mass data exfiltration for extortion. In the vishing vector (tracked by Google Threat Intelligence Group as UNC6040), operators impersonate corporate IT support over the phone and walk victim employees through Salesforce's 'Connect an App' flow, guiding them to enter a connection code that authorizes an attacker-controlled OAuth application impersonating Salesforce's legitimate Data Loader (sometimes rebranded, e.g. 'My Ticket Portal'). This grants the actor a durable OAuth/refresh token that survives password resets and, in many cases, MFA, enabling bulk querying and export of CRM data via the Salesforce REST/Bulk/GraphQL APIs without triggering traditional interactive-login anomaly detections. Once inside, operators pivot to Okta and Microsoft 365 using harvested credentials, and delay extortion demands (branded 'ShinyHunters', operationally handled by UNC6240) by weeks to months after the initial breach, suggesting a data-stockpiling strategy before a 72-hour Bitcoin-ransom ultimatum is issued via phone and email, backed by a Tor-hosted data leak site. A parallel and overlapping supply-chain vector (tracked as UNC6395) compromised OAuth/refresh tokens for the Salesloft Drift third-party integration between August 8 and August 18, 2025, giving attackers programmatic access to ~760 downstream Salesforce customer orgs; the actors specifically harvested secondary credentials (AWS AKIA access keys, Snowflake tokens, passwords) staged inside CRM case/support records, indicating credential-harvesting-for-further-compromise as a core objective, not merely CRM data theft. Google's Threat Intelligence Group has stated it has not found compelling evidence directly linking UNC6395 to ShinyHunters despite the group's public claims. A third, related vector abused misconfigured Salesforce Experience Cloud 'Aura' guest-user API endpoints with GraphQL-based requests to bulk-retrieve data beyond intended guest-access limits (observed June 19-22, 2026, and more broadly since March 2026, ~400 victims). Additional supply-chain compromises hit Gainsight's published Salesforce connected app (November 2025, 200+ instances) and Klue (June 2026, credential theft enabling direct Salesforce API queries, e.g. from IP 138.226.246.94 on June 11, 2026). Microsoft explicitly states none of this stems from a Salesforce platform vulnerability — it is entirely OAuth-trust and configuration abuse. ShinyHunters operates as part of a broader, fluid criminal collaboration ecosystem alongside Scattered Spider (UNC3944) and Lapsus$ remnants, publicly referred to as 'Scattered Lapsus$ Hunters' / 'Sp1d3rHunters', and has claimed 40+ breaches in 2026 alone across retail, education, manufacturing, technology, finance, luxury retail, telecom, healthcare, and critical infrastructure sectors.

## MITRE ATT&CK

- T1589.003 Employee Names
- T1583.001 Domains
- T1585 Establish Accounts
- T1566.004 Spearphishing Voice
- T1598.003 Spearphishing Link
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1204.001 Malicious Link
- T1671 Cloud Application Integration
- T1098 Account Manipulation
- T1550.004 Web Session Cookie
- T1684.001 Impersonation
- T1528 Steal Application Access Token
- T1110.004 Credential Stuffing
- T1185 Browser Session Hijacking
- T1621 Multi-Factor Authentication Request Generation
- T1056 Input Capture
- T1526 Cloud Service Discovery
- T1087 Account Discovery
- T1550 Use Alternate Authentication Material
- T1213.004 Customer Relationship Management Software
- T1005 Data from Local System
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1090.003 Multi-hop Proxy
- T1567 Exfiltration Over Web Service
- T1567.002 Exfiltration to Cloud Storage
- T1020 Automated Exfiltration
- T1657 Financial Theft
- T1491.001 Internal Defacement

## Sources

- [Defending SaaS-based applications against ShinyHunters' OAuth abuse](https://www.microsoft.com/en-us/security/blog/2026/07/13/defending-saas-based-applications-against-shinyhunters-oauth-abuse/)
- [Widespread Data Theft Targets Salesforce Instances via Salesloft Drift](https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift)
- [The Cost of a Call: From Voice Phishing to Data Extortion](https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion)
- [ShinyHunters and UNC6395: Inside the Salesforce and Salesloft Breaches](https://www.mitiga.io/blog/shinyhunters-and-unc6395-inside-the-salesforce-and-salesloft-breaches)
- [ShinyHunters claims 1.5 billion Salesforce records stolen in Drift hacks](https://www.bleepingcomputer.com/news/security/shinyhunters-claims-15-billion-salesforce-records-stolen-in-drift-hacks/)
- [Reviewing the Salesforce-Salesloft Drift OAuth Supply Chain Breach](https://www.anomali.com/blog/salesloft-drift-breach-recap)
- [Salesloft Drift Breach: Everything You Need to Know](https://socradar.io/blog/salesloft-drift-breach-everything-you-need-to-know/)
- [UNC6395 targets Salesloft in Drift OAuth token theft campaign](https://securityaffairs.com/181632/hacking/unc6395-targets-salesloft-in-drift-oauth-token-theft-campaign.html)
- [Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks](https://www.bleepingcomputer.com/news/security/salesloft-breached-to-steal-oauth-tokens-for-salesforce-data-theft-attacks/)
- [Google: Salesforce Attacks Stemmed From Third-Party App](https://www.darkreading.com/cyberattacks-data-breaches/google-salesforce-attacks-third-party-app)
- [Google Salesforce Breach: A Deep dive into the chain and extent of the compromise](https://www.seqrite.com/blog/google-salesforce-breach-unc6040-threat-research/)
- [What Salesforce Organizations Need to Know About ShinyHunters and Vishing](https://www.varonis.com/blog/salesforce-vishing-threat-unc604)
- [ShinyHunters Threat Actor Profile: TTPs, IoCs & Attacks](https://www.huntress.com/threat-library/threat-actors/shinyhunters)
- [Extortion gang opens data leak site to squeeze victims of its Salesforce attacks](https://www.csoonline.com/article/4067846/extortion-gang-opens-data-leak-site-to-squeeze-victims-of-its-salesforce-attacks.html)
- [Chaotic Scattered Shiny Lapsus$ Spider: Information Warfare](https://flare.io/learn/resources/chaotic-scattered-shiny-lapsus-spider)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1275