# Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Attack Paths (UNC6040/UNC6240/UNC6395/GRUB1/Storm-3138)

> Microsoft, alongside Google GTIG/Mandiant, Cloudflare Cloudforce One, and Salesforce, mapped a year-long campaign (mid-2025 to mid-2026) by ShinyHunters-linked actor clusters targeting Salesforce customer environments across retail, education, security, and manufacturing sectors. Attackers used three non-vulnerability OAuth-abuse paths: vishing-driven malicious connected-app consent, stolen third-party OAuth tokens from Salesloft/Drift, Gainsight, and Klue integrations, and misconfigured Salesforce Experience Cloud guest-user access to Aura endpoints.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1288
- **ID:** TL-2026-1288
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between mid-2025 and mid-2026, ShinyHunters-affiliated actor clusters (tracked variously by Google GTIG as UNC6040 for initial access and UNC6240 for extortion, by Google as UNC6395 for the Drift OAuth-token theft, by Cloudflare Cloudforce One as GRUB1, and by Microsoft as Storm-3138 for the Klue incident) ran a sustained campaign against Salesforce customer environments that did not exploit any Salesforce platform vulnerability, but instead abused three distinct identity/OAuth trust paths.

Path 1 (vishing/malicious connected apps): English-speaking callers impersonating internal IT support socially engineered Salesforce end users into visiting Salesforce's legitimate 'connected app' authorization page and approving a rogue app (frequently disguised as a modified Salesforce Data Loader or generically named app such as 'My Ticket Portal'). Once a victim approved the OAuth consent screen, the attacker's application received a valid access/refresh token and could make Salesforce REST/Bulk API calls as that user indefinitely, enabling slow, low-noise, high-volume record exfiltration that produced no anomalous sign-in event because the underlying session belonged to a real, already-authenticated user.

Path 2 (stolen third-party OAuth tokens): Threat actors compromised the source-code repositories or CI pipelines of Salesforce ISV/integration vendors and harvested hardcoded or leaked OAuth client secrets and refresh tokens using tools such as TruffleHog. The Salesloft/Drift incident (root-caused to attacker access on Salesloft's GitHub organization as early as March 2025, with active token abuse identified August 8-18, 2025) exposed Drift's Salesforce, Slack, and Google Workspace integration tokens, giving attackers direct API access to an estimated 700+ downstream Salesforce customer orgs, including major security vendors (Cloudflare, Zscaler, Palo Alto Networks, Proofpoint, Tenable, CyberArk, Elastic, BeyondTrust, JFrog, Rubrik, Cato Networks, Workiva). A near-identical follow-on compromise of Gainsight-published Salesforce apps in November 2025 affected 200-285 additional Salesforce instances (Atlassian, DocuSign, F5, GitLab, Malwarebytes, SonicWall, Thomson Reuters, Verizon among victims). A third vendor compromise, of Klue (tracked by Microsoft as Storm-3138, publicly claimed by an actor using the 'Icarus' handle) in June 2026, reused a legacy/abandoned test-integration credential to push a malicious code update that harvested customer OAuth tokens, affecting Klue's Salesforce-integrated customers including Huntress and Recorded Future.

Path 3 (Experience Cloud guest-access misconfiguration): In parallel, actors probed Salesforce Experience Cloud sites with overly permissive unauthenticated 'Guest User' profiles, using a reconnaissance/mass-scanning tool dubbed AuraInspector to enumerate exposed Aura/GraphQL API endpoints. Where guest-object permissions or sharing rules were misconfigured, attackers issued unauthenticated SOQL queries against the Aura controller and used cursor-based pagination to bypass Salesforce's standard 2,000-record query cap, bulk-extracting records (including support-case attachments containing AWS access keys, Snowflake tokens, and plaintext passwords) and deleting query-job history afterward to hinder forensic reconstruction.

All three paths converge on the same underlying detection gap Microsoft's report highlights: identity security programs (MFA, conditional access, session policies) are built around human logins, while OAuth connected apps, integration/service accounts, and API tokens sit largely outside those controls, are frequently over-permissioned, and in many orgs go unreviewed for months (Microsoft flagged connected apps inactive 90+ days that still retained live, unscoped permissions as a top risk indicator). Confirmed and reported victim organizations across the combined campaign include Google (June 2025), Chanel, Pandora, Adidas, Qantas, Allianz Life, multiple LVMH brands, Cloudflare, Zscaler, Palo Alto Networks, Proofpoint, PagerDuty, Tanium, Huntress, and Recorded Future, with ShinyHunters publicly (and only partly verified) claiming roughly 1,000 total affected organizations. Microsoft's response includes an enhanced Defender for Cloud Apps Salesforce connector with Real-Time Event Monitoring integration, per-app OAuth risk scoring (0-100), and dormant-but-privileged connected-app detection.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1585.001 Social Media Accounts
- T1566.004 Spearphishing Voice
- T1566.002 Spearphishing Link
- T1199 Trusted Relationship
- T1195.002 Compromise Software Supply Chain
- T1204.001 Malicious Link
- T1098.003 Additional Cloud Roles
- T1528 Steal Application Access Token
- T1111 Multi-Factor Authentication Interception
- T1552.001 Credentials In Files
- T1550.001 Application Access Token
- T1070 Indicator Removal
- T1684.001 Impersonation
- T1526 Cloud Service Discovery
- T1087.004 Cloud Account
- T1069.003 Cloud Groups
- T1530 Data from Cloud Storage
- T1119 Automated Collection
- T1102 Web Service
- T1567.002 Exfiltration to Cloud Storage
- T1537 Transfer Data to Cloud Account
- T1657 Financial Theft

## Sources

- [Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths](https://thehackernews.com/2026/07/microsoft-maps-year-long-shinyhunters.html)
- [Google Salesforce Breach: A Deep dive into the chain and extent of the compromise](https://www.seqrite.com/blog/google-salesforce-breach-unc6040-threat-research/)
- [ShinyHunters and UNC6395: Inside the Salesforce and Salesloft Breaches](https://www.mitiga.io/blog/shinyhunters-and-unc6395-inside-the-salesforce-and-salesloft-breaches)
- [FBI warns about 2 campaigns targeting Salesforce instances](https://www.cybersecuritydive.com/news/fbi-warns-campaigns-salesforce-instances/760129/)
- [Detecting ShinyHunters/UNC6040 Vishing Campaigns in Salesforce OAuth Attacks](https://appomni.com/blog/detecting-unc6040-vishing-in-salesforce-oauth-attacks/)
- [The Master Key Problem: Inside the Salesloft Breach and Ongoing Threat](https://www.illumio.com/blog/the-master-key-problem-what-the-salesloft-breach-reveals-about-an-ongoing-threat)
- [ShinyHunters Threat Actor Profile: TTPs, IoCs & Attacks](https://www.huntress.com/threat-library/threat-actors/shinyhunters)
- [How New Supply Chain Attacks Challenge SaaS Security: Lessons from UNC6395 and UNC6040 (ShinyHunters)](https://appomni.com/blog/saas-supply-chain-attacks-unc6395-unc6040/)
- [The Attack Surface Most Companies Aren't Watching: Their CRM](https://centrexit.com/blog/crm-attack-surface-shinyhunters-salesforce-2026/)
- [Google Salesforce Breach](https://www.pureid.io/google-salesforce-breach/)
- [6.5M Odido Customers Hit: ShinyHunters €1M Ransom](https://shattered.io/shinyhunters-odido-breach-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1288