Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Attack Paths (UNC6040/UNC6240/UNC6395/GRUB1/Storm-3138)
Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data (TL-2026-1288), also tracked as ShinyHunters Salesforce OAuth Campaign, is a high-severity data breach, first published 2026-07-14. It is attributed to ShinyHunters with medium confidence, affects Salesforce Salesforce CRM (Connected Apps / OAuth), maps to 24 MITRE ATT&CK techniques (T1069.003, T1070, T1087.004), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-1288
- Threat ID
- TL-2026-1288
- Also known as
- ShinyHunters Salesforce OAuth Campaign, Salesloft Drift Token Theft, GRUB1 Salesforce Campaign, Salesforce Aura Guest-Access Exploitation
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- 2026-07-14
- Last reviewed
- 2026-07-14
- Attribution
- ShinyHunters
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- retail, education, manufacturing, technology, cybersecurity, financialservices, insurance, aviation, luxurygoods, healthcaretechnology
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data
Malware and tooling: AuraInspector, Salesforce Data Loader, TruffleHog - S9009
Microsoft, alongside Google GTIG/Mandiant, Cloudflare Cloudforce One, and Salesforce, mapped a year-long campaign (mid-2025 to mid-2026) by ShinyHunters-linked actor clusters targeting Salesforce customer environments across retail, education, security, and manufacturing sectors. Attackers used three non-vulnerability OAuth-abuse paths: vishing-driven malicious connected-app consent, stolen third-party OAuth tokens from Salesloft/Drift, Gainsight, and Klue integrations, and misconfigured Salesforce Experience Cloud guest-user access to Aura endpoints.
How Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data works
Between mid-2025 and mid-2026, ShinyHunters-affiliated actor clusters (tracked variously by Google GTIG as UNC6040 for initial access and UNC6240 for extortion, by Google as UNC6395 for the Drift OAuth-token theft, by Cloudflare Cloudforce One as GRUB1, and by Microsoft as Storm-3138 for the Klue incident) ran a sustained campaign against Salesforce customer environments that did not exploit any Salesforce platform vulnerability, but instead abused three distinct identity/OAuth trust paths.
Path 1 (vishing/malicious connected apps): English-speaking callers impersonating internal IT support socially engineered Salesforce end users into visiting Salesforce's legitimate 'connected app' authorization page and approving a rogue app (frequently disguised as a modified Salesforce Data Loader or generically named app such as 'My Ticket Portal'). Once a victim approved the OAuth consent screen, the attacker's application received a valid access/refresh token and could make Salesforce REST/Bulk API calls as that user indefinitely, enabling slow, low-noise, high-volume record exfiltration that produced no anomalous sign-in event because the underlying session belonged to a real, already-authenticated user.
Path 2 (stolen third-party OAuth tokens): Threat actors compromised the source-code repositories or CI pipelines of Salesforce ISV/integration vendors and harvested hardcoded or leaked OAuth client secrets and refresh tokens using tools such as TruffleHog. The Salesloft/Drift incident (root-caused to attacker access on Salesloft's GitHub organization as early as March 2025, with active token abuse identified August 8-18, 2025) exposed Drift's Salesforce, Slack, and Google Workspace integration tokens, giving attackers direct API access to an estimated 700+ downstream Salesforce customer orgs, including major security vendors (Cloudflare, Zscaler, Palo Alto Networks, Proofpoint, Tenable, CyberArk, Elastic, BeyondTrust, JFrog, Rubrik, Cato Networks, Workiva). A near-identical follow-on compromise of Gainsight-published Salesforce apps in November 2025 affected 200-285 additional Salesforce instances (Atlassian, DocuSign, F5, GitLab, Malwarebytes, SonicWall, Thomson Reuters, Verizon among victims). A third vendor compromise, of Klue (tracked by Microsoft as Storm-3138, publicly claimed by an actor using the 'Icarus' handle) in June 2026, reused a legacy/abandoned test-integration credential to push a malicious code update that harvested customer OAuth tokens, affecting Klue's Salesforce-integrated customers including Huntress and Recorded Future.
Path 3 (Experience Cloud guest-access misconfiguration): In parallel, actors probed Salesforce Experience Cloud sites with overly permissive unauthenticated 'Guest User' profiles, using a reconnaissance/mass-scanning tool dubbed AuraInspector to enumerate exposed Aura/GraphQL API endpoints. Where guest-object permissions or sharing rules were misconfigured, attackers issued unauthenticated SOQL queries against the Aura controller and used cursor-based pagination to bypass Salesforce's standard 2,000-record query cap, bulk-extracting records (including support-case attachments containing AWS access keys, Snowflake tokens, and plaintext passwords) and deleting query-job history afterward to hinder forensic reconstruction.
All three paths converge on the same underlying detection gap Microsoft's report highlights: identity security programs (MFA, conditional access, session policies) are built around human logins, while OAuth connected apps, integration/service accounts, and API tokens sit largely outside those controls, are frequently over-permissioned, and in many orgs go unreviewed for months (Microsoft flagged connected apps inactive 90+ days that still retained live, unscoped permissions as a top risk indicator). Confirmed and reported victim organizations across the combined campaign include Google (June 2025), Chanel, Pandora, Adidas, Qantas, Allianz Life, multiple LVMH brands, Cloudflare, Zscaler, Palo Alto Networks, Proofpoint, PagerDuty, Tanium, Huntress, and Recorded Future, with ShinyHunters publicly (and only partly verified) claiming roughly 1,000 total affected organizations. Microsoft's response includes an enhanced Defender for Cloud Apps Salesforce connector with Real-Time Event Monitoring integration, per-app OAuth risk scoring (0-100), and dormant-but-privileged connected-app detection.
MITRE ATT&CK techniques used in TL-2026-1288
Discovery
T1069.003 Cloud Groups; T1087.004 Cloud Account; T1526 Cloud Service Discovery
Defense Evasion
Persistence
T1098.003 Additional Cloud Roles
Command and Control
Credential Access
T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token; T1552.001 Credentials In Files
Collection
T1119 Automated Collection; T1530 Data from Cloud Storage
Initial Access
T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship; T1566.002 Spearphishing Link; T1566.004 Spearphishing Voice
Execution
Exfiltration
T1537 Transfer Data to Cloud Account; T1567.002 Exfiltration to Cloud Storage
lateral-movement
T1550.001 Application Access Token
Resource Development
T1583 Acquire Infrastructure; T1585.001 Social Media Accounts
Reconnaissance
T1589 Gather Victim Identity Information
Impact
stealth
Affected products and versions in Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data
- Salesforce — Salesforce CRM (Connected Apps / OAuth)
Vulnerable versions: all instances with over-permissioned or unreviewed connected apps
Fixed in: N/A - misconfiguration/social-engineering, no platform patch - Salesforce — Experience Cloud (Guest User / Aura endpoints)
Vulnerable versions: instances with misconfigured Guest User object/field-level sharing
Fixed in: N/A - requires manual sharing-rule remediation - Salesloft — Drift (Salesforce/Slack/Google Workspace integration)
Vulnerable versions: OAuth tokens issued before August 2025 remediation
Fixed in: Salesloft revoked and rotated all Drift integration tokens, September 2025 - Gainsight — Gainsight Salesforce-published apps
Vulnerable versions: OAuth tokens issued before November 2025 remediation
Fixed in: Salesforce pulled affected Gainsight apps from AppExchange, November 2025 - Klue — Klue Salesforce integration
Vulnerable versions: legacy/abandoned test-integration credential active through June 2026
Fixed in: credential revoked, June 2026
Remediation for Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data
Immediate actions
- Inventory and review all Salesforce connected apps and their granted OAuth scopes; revoke unused or over-permissioned apps
- Force-revoke and rotate OAuth refresh tokens for Salesloft/Drift, Gainsight, and Klue integrations regardless of confirmed compromise
- Lock down Salesforce Experience Cloud Guest User profile permissions and object/field-level sharing rules; disable guest access to Aura/GraphQL endpoints not explicitly required
- Search Salesforce Setup Audit Trail and Event Monitoring logs for bulk API/SOQL activity from connected apps, especially high-volume Bulk API record pulls and deleted async query jobs
- Rotate any credentials (AWS keys, Snowflake tokens, passwords) discovered stored in plaintext within Salesforce Case/Support objects or attachments
Workarounds
- Disable or restrict Salesforce Data Loader connected-app usage to specific IP ranges/profiles via Login IP Ranges and Connected App IP Relaxation settings
- Set Experience Cloud Guest User license to read-only minimum required objects until sharing rules are audited
Longer-term hardening
- Connect Salesforce to a CASB/SSPM (e.g., Microsoft Defender for Cloud Apps, AppOmni) for continuous OAuth app risk scoring and anomaly detection
- Establish a recurring (90-day) connected-app access review with automatic flagging of dormant-but-privileged apps
- Implement least-privilege OAuth scoping and mandatory admin approval workflow for all new connected-app installs
- Extend identity-security programs (MFA, conditional access, session risk policies) to cover service accounts, integration accounts, and OAuth client credentials, not just human logins
- Provide employee vishing-awareness training specific to Salesforce/IT-support impersonation and connected-app consent-phishing
Weaknesses (CWE) in Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data
CWE-287, CWE-284, CWE-269, CWE-522
Timeline of Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data
- Attackers gain access to Salesloft's GitHub organization, later identified as the root cause of the Drift OAuth token theft
- UNC6040/UNC6240 vishing campaign compromises Google's corporate Salesforce instance, first publicly documented by Google GTIG
- UNC6395 begins active abuse of stolen Salesloft/Drift OAuth and refresh tokens against Salesforce customer orgs
- Active exploitation window for stolen Drift tokens closes; Google estimates 700+ organizations potentially exposed
- Salesloft revokes and rotates all Drift integration OAuth tokens and secrets following disclosure
- FBI issues warning covering two distinct campaigns targeting Salesforce instances
- Gainsight-published Salesforce apps compromised via similar OAuth token theft; Salesforce pulls affected apps after detecting unusual API activity, affecting 200-285 instances
- Related ShinyHunters-ecosystem vishing campaign (UNC6661/UNC6671 infrastructure) targets Okta-fronted orgs including Wynn Resorts, Odido, Panera Bread, and several universities
- Klue Salesforce integration compromised (Storm-3138 / actor using 'Icarus' handle) via a legacy test-integration credential; malicious code update harvests customer OAuth tokens, affecting Huntress and Recorded Future
- Microsoft, jointly with Google GTIG/Mandiant, Cloudflare Cloudforce One, and Salesforce, publishes a consolidated year-long campaign report mapping all three attack paths and releasing enhanced Defender for Cloud Apps detection capability
Sources cited for Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data
- Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths
- Google Salesforce Breach: A Deep dive into the chain and extent of the compromise
- ShinyHunters and UNC6395: Inside the Salesforce and Salesloft Breaches
- FBI warns about 2 campaigns targeting Salesforce instances
- Detecting ShinyHunters/UNC6040 Vishing Campaigns in Salesforce OAuth Attacks
- The Master Key Problem: Inside the Salesloft Breach and Ongoing Threat
- ShinyHunters Threat Actor Profile: TTPs, IoCs & Attacks
- How New Supply Chain Attacks Challenge SaaS Security: Lessons from UNC6395 and UNC6040 (ShinyHunters)
- The Attack Surface Most Companies Aren't Watching: Their CRM
- Google Salesforce Breach
- 6.5M Odido Customers Hit: ShinyHunters €1M Ransom
Threats related to Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data
- ShinyHunters/UNC6040 Abuse OAuth Connected-App Approvals for Persistent Salesforce Access
- Check Point 2026 AI Security Report: Autonomous AI-Driven Exploitation, CLAUDE.md Jailbreaking, and Generative Identity Fraud Fuel Scattered Spider / ShinyHunters Campaigns
- ShinyHunters (UNC6040/UNC6395) OAuth Consent Abuse Against Salesforce and Connected SaaS Integrations
- AI Agent Identities Emerge as the Enterprise's Fastest-Growing Attack Surface: OAuth Tokens, Shadow AI, and AI-Driven EDR Evasion (STAC6994, UNC6395, NadMesh)
- ShinyHunters (UNC6040) OAuth Abuse & UNC6395 Salesloft/Drift Supply-Chain Compromise Targeting Salesforce Environments
- Infinite Campus Salesforce Breach by ShinyHunters / UNC6040 — 137,100 K-12 School Staff Accounts Exfiltrated and Extorted
Detection coverage for TL-2026-1288
As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1288 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.