# ShinyHunters/UNC6040 Abuse OAuth Connected-App Approvals for Persistent Salesforce Access

> Threat actors linked to ShinyHunters (tracked by Google as UNC6040, with follow-on extortion activity as UNC6240) run voice-phishing campaigns impersonating IT support to trick employees into authorizing malicious OAuth connected apps disguised as Salesforce's own Data Loader tool. A single OAuth approval grants the attacker the authorizing user's full Salesforce privileges without further password prompts, enabling persistent API-level access to enumerate instances, exfiltrate CRM data, and pivot into Okta/Microsoft 365, while evading standard sign-in monitoring.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1311
- **ID:** TL-2026-1311
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Microsoft and Google Threat Intelligence have mapped a year-long (mid-2025 to mid-2026) campaign of Salesforce compromises tied to the ShinyHunters extortion brand and the financially motivated cluster UNC6040. The campaign relies on abusing legitimate OAuth trust relationships rather than exploiting a software vulnerability, and manifests across three distinct attack paths.

The first and primary path is voice-phishing (vishing) driven OAuth consent abuse: attackers cold-call employees, impersonate internal IT support, and talk the victim through Salesforce's OAuth App Manager / connected-app authorization screen, guiding them to approve an attacker-controlled connected application disguised as the legitimate Salesforce Data Loader data-migration tool. Because Salesforce's connected-app OAuth flow inherits the authorizing user's existing privileges once consent is granted, the attacker receives full API-level access under that user's identity without needing a password or a second MFA prompt going forward. This access is durable — it persists via refresh tokens (grant type refresh_token/offline_access) until explicitly revoked — and produces API traffic that is largely indistinguishable from normal integration or user activity to conventional sign-in and authentication monitoring, since the requests originate from a real, previously-authenticated identity.

Once authorized, the connected app is used to enumerate Salesforce org metadata and objects, run SOQL queries (Query/QueryMore/QueryAll) and Bulk API jobs against high-value objects (Accounts, Contacts, Cases, Opportunities), and export records in bulk. Analysts observed the attackers specifically combing exfiltrated case/support text and account records for secondary secrets — plaintext AWS access keys, VPN credentials, Snowflake tokens, and other credentials — that enable lateral movement into adjacent SaaS and cloud environments (Okta, Microsoft 365/Entra ID), extending the blast radius well beyond the Salesforce tenant itself. Extortion demands, when made, are issued weeks to months after the initial data theft, consistent with a broker/monetization relationship between the initial-access cluster (UNC6040) and the ShinyHunters extortion brand (also associated with the UNC6240 designation for the extortion/leak-site operations).

The second attack path is supply-chain compromise of trusted third-party OAuth-integrated vendors whose connected apps hold standing, broadly-scoped access to customer Salesforce orgs. In August 2025, the cluster tracked as UNC6395 stole OAuth access and refresh tokens for the Salesloft Drift AI chatbot integration and used them, over roughly a ten-day window (Aug 9-17, 2025), to run automated SOQL queries and bulk exports against more than 700 downstream Salesforce customer environments (including named victims such as Cloudflare, Google, PagerDuty, Palo Alto Networks, Proofpoint, SpyCloud, Tanium, and Zscaler), again hunting for embedded secrets in support-case text. Salesloft and Salesforce jointly revoked all active Drift access/refresh tokens on August 20, 2025 and engaged Mandiant to investigate. The same abuse-of-trusted-integration pattern recurred with the Gainsight published Salesforce application in November 2025 and with the Klue competitive-intelligence integration in June 2026, in both cases using compromised or abused OAuth credentials belonging to the vendor application to reach many downstream customer orgs simultaneously, giving the actor's activity the outward appearance of legitimate vendor integration traffic.

The third attack path targets Salesforce Experience Cloud sites with misconfigured/over-permissioned Guest User (unauthenticated) access. Between June 19-22, 2026, actors chained requests against the Salesforce Aura framework's unauthenticated endpoints and layered GraphQL-based queries on top of them, which allowed them to bypass the normal per-request record-count limitations that guest-user API calls are subject to and extract far larger volumes of org data than the guest-access design was intended to permit.

Victims span retail, education, and manufacturing sectors, and the campaign's scale (per ShinyHunters' own, unverified claims) reportedly reached close to 1,000 organizations across the Salesloft/Drift and Gainsight waves combined. No CVE applies: this is abuse of legitimate OAuth/connected-app and guest-access functionality, not a software vulnerability.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1585 Establish Accounts
- T1566.004 Spearphishing Voice
- T1199 Trusted Relationship
- T1195.002 Compromise Software Supply Chain
- T1204.001 Malicious Link
- T1098.003 Additional Cloud Roles
- T1078.004 Cloud Accounts
- T1078.004 Cloud Accounts
- T1550.001 Application Access Token
- T1078.004 Cloud Accounts
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1526 Cloud Service Discovery
- T1087.004 Cloud Account
- T1580 Cloud Infrastructure Discovery
- T1550.001 Application Access Token
- T1530 Data from Cloud Storage
- T1119 Automated Collection
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1657 Financial Theft
- T1485 Data Destruction

## Sources

- [One Malicious OAuth Approval Can Give Hackers Persistent Access to Salesforce Data](https://cybersecuritynews.com/one-malicious-oauth-approval/)
- [Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity](https://thehackernews.com/2026/07/microsoft-maps-year-long-shinyhunters.html)
- [Defending SaaS-based applications against ShinyHunters OAuth abuse](https://www.microsoft.com/en-us/security/blog/2026/07/13/defending-saas-based-applications-against-shinyhunters-oauth-abuse/)
- [Cybercrime Observations from the Frontlines: UNC6040 Proactive Hardening Recommendations](https://cloud.google.com/blog/topics/threat-intelligence/unc6040-proactive-hardening-recommendations)
- [Investigate how the ShinyHunters used vishing to compromise Salesforce instances](https://www.cyberbit.com/campaign/shinyhunters-salesforce-vishing-attack/)
- [Detecting ShinyHunters/UNC6040 Vishing Campaigns in Salesforce OAuth Attacks](https://appomni.com/blog/detecting-unc6040-vishing-in-salesforce-oauth-attacks/)
- [ShinyHunters and UNC6395: Inside the Salesforce and Salesloft Breaches](https://www.mitiga.io/blog/shinyhunters-and-unc6395-inside-the-salesforce-and-salesloft-breaches)
- [ShinyHunters Hackers Abuse Salesforce OAuth to Bypass MFA and Exfiltrate CRM Data](https://gbhackers.com/salesforce-oauth-abused/amp/)
- [Active Exploitation Alert: ShinyHunters Abuse OAuth and Vendor Integrations to Breach Salesforce and SaaS Environments](https://www.rescana.com/post/active-exploitation-alert-shinyhunters-abuse-oauth-and-vendor-integrations-to-breach-salesforce-and-saas-environments)
- [What Salesforce Organizations Need to Know About ShinyHunters and Vishing](https://www.varonis.com/blog/salesforce-vishing-threat-unc604)
- [Reviewing the Salesforce–Salesloft Drift OAuth Supply Chain Breach](https://www.anomali.com/blog/salesloft-drift-breach-recap)
- [Widespread Data Theft Targets Salesforce Instances via Salesloft Drift](https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1311