# ShinyHunters (UNC6040) OAuth Abuse & UNC6395 Salesloft/Drift Supply-Chain Compromise Targeting Salesforce Environments

> Two overlapping 2025 criminal campaigns compromised Salesforce environments at scale: UNC6040 used IT-support vishing calls to trick employees into authorizing a weaponized Salesforce Data Loader OAuth Device Flow app, exfiltrated CRM data, and issued Bitcoin ransom demands under the ShinyHunters/UNC6240 name. Separately, UNC6395 compromised Salesloft's GitHub account (March-June 2025), pivoted into Drift's AWS environment to steal Drift-Salesforce OAuth/refresh tokens, and exfiltrated data from dozens of customer Salesforce instances via Tor between August 8-18, 2025 -- hitting Cloudflare, Tenable, Palo Alto Networks, Zscaler, and many others. Both clusters converged in an October 2025 mass-extortion campaign run by the 'Scattered LAPSUS$ Hunters' collective (ShinyHunters + Scattered Spider + Lapsus$).

- **Published:** 2026-07-26T00:00:00Z
- **Last reviewed:** 2026-07-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1711
- **ID:** TL-2026-1711
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This threat covers two technically distinct but operationally converging non-malware, identity-centric campaigns against the Salesforce SaaS ecosystem in 2025.

Campaign 1 -- UNC6040 (publicly reported by Google Threat Intelligence Group in June 2025): a financially motivated cluster specializing in voice phishing (vishing). Operators call English-speaking employees at multinational organizations, impersonate internal IT support, and talk the victim through authorizing a connected application in their company's Salesforce org. The group's signature technique abuses Salesforce's OAuth Device Flow: the attacker pre-configures a local instance of the (initially unmodified, later custom-built Python) Salesforce Data Loader tool, which generates an 8-character device code. The victim, believing they are completing an IT-support-directed setup step, is guided to Salesforce's legitimate device-verification page, enters the code, and authenticates -- silently issuing an OAuth access token to the attacker's Data Loader instance. The tool then listens for the successful authentication and begins slow, low-and-slow data exfiltration to avoid detection, later escalating to full-table exports once verified. UNC6040 also harvested credentials and MFA approvals directly during vishing calls for lateral movement into Okta and Microsoft 365. Google's own corporate Salesforce instance was compromised via this technique in June 2025. Extortion follow-up, tracked separately by Google as UNC6240, arrives weeks to months later via email/phone, demanding 4-20 BTC within 72 hours and invoking the ShinyHunters name.

Campaign 2 -- UNC6395: threat actors gained unauthorized access to Salesloft's GitHub organization between approximately March and June 2025, downloading private repository content as ZIP archives, adding a guest user, and conducting reconnaissance across both the Salesloft and Drift (Salesloft's AI-powered sales-engagement/chat product) application environments. This access was later used to pivot into Drift's AWS environment, where the actor obtained OAuth and refresh tokens issued for Drift's Salesforce, Google Workspace, Outlook, and other customer integrations. Beginning August 8, 2025 (confirmed exfiltration August 12-18), UNC6395 used the stolen Drift-Salesforce tokens to run systematic SOQL reconnaissance (COUNT() queries against Account, Opportunity, User, and Case objects) followed by bulk exports, specifically hunting exported data for AWS access keys (AKIA-prefixed), Snowflake tokens, plaintext passwords, and internal VPN/SSO URLs for follow-on access. The actor deleted its own Salesforce query jobs to reduce forensic visibility and routed exfiltration traffic through Tor exit nodes to complicate attribution. On August 9, compromised 'Drift Email' tokens were separately used to access a limited set of customer Google Workspace accounts. Salesloft and Salesforce revoked all Drift OAuth/refresh tokens and pulled Drift from the AppExchange on August 20, 2025; Google's Threat Intelligence Group published a public UNC6395 advisory on August 26, with scope expanded on August 28 to confirm impact beyond the core Salesforce integration.

Dozens of organizations across technology, cybersecurity, retail/luxury, insurance, aviation, and logistics sectors confirmed impact from the Drift token theft, including Cloudflare (104 exposed API tokens, rotated), Tenable, Palo Alto Networks, Zscaler, PagerDuty, SpyCloud, Proofpoint, Rubrik, Allianz Life, and Farmers Insurance. The FBI issued a FLASH/IC3 advisory (CSA-250912) on September 12, 2025 covering both clusters. In October 2025, a collective calling itself 'Scattered LAPSUS$ Hunters' -- claiming joint ShinyHunters, Scattered Spider, and Lapsus$ membership -- launched a Tor-hosted extortion/leak site listing over three dozen Salesforce victims (including Toyota, FedEx, Disney/Hulu, UPS, Adidas, Dior, Louis Vuitton, Chanel, Tiffany & Co., Cartier, Qantas, and Air France-KLM), demanding Salesforce itself pay a collective ransom by October 10, 2025 or see all listed customer data leaked. Neither campaign exploited a Salesforce software vulnerability; both are pure identity/OAuth-trust abuse against the SaaS supply chain.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1566 Phishing
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1550 Use Alternate Authentication Material
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1090 Proxy
- T1070 Indicator Removal
- T1036 Masquerading
- T1078 Valid Accounts
- T1621 Multi-Factor Authentication Request Generation
- T1552 Unsecured Credentials
- T1526 Cloud Service Discovery
- T1087 Account Discovery
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1537 Transfer Data to Cloud Account
- T1657 Financial Theft

## Sources

- [ShinyHunters and UNC6395: Inside the Salesforce and Salesloft Breaches](https://www.mitiga.io/blog/shinyhunters-and-unc6395-inside-the-salesforce-and-salesloft-breaches)
- [Data Theft from Salesforce Instances via Salesloft Drift](https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift)
- [Voice Phishing and Data Extortion: UNC6040 Targets Salesforce](https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion)
- [Google Exposes Vishing Group UNC6040 Targeting Salesforce with Fake Data Loader App](https://thehackernews.com/2025/06/google-exposes-vishing-group-unc6040.html)
- [GitHub Account Compromise Led to Salesloft Drift Breach Affecting 22 Companies](https://thehackernews.com/2025/09/github-account-compromise-led-to.html)
- [ShinyHunters Wage Broad Corporate Extortion Spree](https://krebsonsecurity.com/2025/10/shinyhunters-wage-broad-corporate-extortion-spree/)
- [Salesloft Drift attacks hit Cloudflare, Palo Alto Networks, Zscaler](https://cyberscoop.com/salesloft-drift-attacks-cloudflare-palo-alto-networks-zscaler/)
- [Cloudflare hit by data breach in Salesloft Drift supply chain attack](https://www.bleepingcomputer.com/news/security/cloudflare-hit-by-data-breach-in-salesloft-drift-supply-chain-attack/)
- [Salesloft GitHub Account Compromised Months Before Salesforce Attack](https://www.securityweek.com/salesloft-github-account-compromised-months-before-salesforce-attack/)
- [Scattered Lapsus$ Hunters Drops Salesforce Leak Site](https://www.darkreading.com/cyberattacks-data-breaches/scattered-lapsus-hunters-returns-salesforce-leak-site)
- [Scattered Lapsus$ Hunters](https://en.wikipedia.org/wiki/Scattered_Lapsus$_Hunters)
- [FBI FLASH: Cyber Criminal Groups UNC6040 and UNC6395 Targeting Salesforce Platforms (CSA-250912)](https://www.ic3.gov/CSA/2025/250912.pdf)
- [FBI warns about 2 campaigns targeting Salesforce instances](https://www.cybersecuritydive.com/news/fbi-warns-campaigns-salesforce-instances/760129/)
- [Zscaler, Palo Alto Networks, SpyCloud among the affected by Salesloft Drift breach](https://www.helpnetsecurity.com/2025/09/02/zscaler-palo-alto-networks-spycloud-among-the-affected-by-salesloft-breach/)
- [Salesloft Drift Attacks Exposed Zscaler Customer Data](https://www.bankinfosecurity.com/salesloft-drift-attacks-exposed-zscaler-customer-data-a-29344)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1711