The phone call that beat MFA: how ShinyHunters got into Salesforce through OAuth

01One call, one code, one approved app

The FBI dates the voice campaign, which Google tracks as UNC6040, to October 2024. The callers phone a company’s call centre or staff posing as IT support, often about a connectivity problem or “an auto-generated ticket”.³ Google says the group favours the English-speaking branches of multinationals.² What follows is a sequence of ordinary-looking steps, and only the last one is visibly criminal.

“Beat MFA” needs a precise meaning. In step 3 the victim is already signed in; multi-factor authentication has proved who they are, and never asks whether they should hand a key to a stranger’s app. Only step 2, a code read out over the phone, is something MFA could stop, and only a phishing-resistant kind.

02OAuth consent in plain words: a valet key, not a password

OAuth is how one app gets permission to use another on your behalf without ever seeing your password. Think of a valet key: it starts the car but does not open the boot, and the owner hands it over once. Salesforce calls these permitted apps “connected apps”; an administrator or a sufficiently privileged user approves them.³ The weakness is in the hand-over, not the key.

Microsoft saw exactly that last step: discovery, bulk queries and mass exfiltration of accounts, contacts and service cases, “often without sign-in anomalies.”¹ Most buyers have never looked at who is allowed to approve. In Microsoft Entra, by default, “all users are allowed to consent to applications for permissions that don’t require administrator consent”; Microsoft’s own advice is to allow user consent only for apps from verified publishers.⁶ In Salesforce, Google’s advice is to keep the “Manage Connected Apps” and “Customize Application” permissions with trusted admins, and to treat “API Enabled”, which “allows broad data export capabilities”, as a privilege.²

03The second door: tokens stolen from somebody else's integration

The phone call needs a gullible employee. The other route needs only a vendor that has already been connected. Between 8 and 18 August 2025 an actor Google tracks as UNC6395 used stolen Salesloft Drift tokens to export Cases, Accounts, Users and Opportunities from “numerous corporate Salesforce instances”, then searched the haul for AWS keys, passwords and Snowflake tokens.⁴ Salesloft and Salesforce revoked every Drift token on 20 August.³ In November Salesforce revoked the tokens of Gainsight-published apps; Gainsight said it had been breached through tokens linked to Drift.⁵ One theft fed the next.

The latest link is Klue, a competitive-intelligence tool. Klue told customers that attackers got into its backend through “a dormant but still active credential created by Klue for a prototype integration” and pushed a code update that stole customers’ OAuth tokens. Huntress confirmed its Salesforce data was taken; Salesforce disabled the Klue Battlecards app; Klue switched off its HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive and Slack integrations too.⁸ Attribution is contested: Microsoft names the actor that got into Klue Storm-3138,¹ and BleepingComputer ties the extortion emails to a newer group called “Icarus”, not ShinyHunters.⁸ For the buyer it makes no difference. Verizon’s 2026 breach report puts a third party in 48% of breaches.⁹

04Who was hit: what victims confirmed, and what the attackers claim

Extortion groups sell on the size of their claims, so the numbers below are in two columns. Google disclosed that its own corporate Salesforce instance was hit in June 2025 by similar activity, losing “basic and largely publicly available business information.”² The largest 2026 case is Charter Communications: ShinyHunters says it phoned a Charter employee on 1 April, took over their Microsoft Entra account and exported customer records from Salesforce.¹⁰

Have I Been Pwned counted 4.9 million accounts in the data leaked after Charter refused to pay; Charter said only “sales tools used to manage current, past and prospective Business customers were impacted.”¹¹ At Instructure, the company behind the Canvas learning platform, BleepingComputer reports several attacks, Canvas outages, data on tens of millions of students, and an “agreement” with the group.¹⁰ The right-hand column was told to BleepingComputer by the attackers; none of it has been confirmed by Salesforce or the companies named.⁵⁷

This activity was not the result of a vulnerability inherent to Salesforce.

05What Microsoft says to do, and what its list leaves out

Microsoft’s defences are specific.¹ Its first is to connect Salesforce to Microsoft Defender for Cloud Apps, which is its own product; read that as one way to do the job, not the only one. Every other step can be done with Salesforce’s own controls, and we have put them in the order we would do them.

Steps 1 to 5 come from Microsoft and Google.¹²⁴ Step 6 is the FBI’s.³ After any vendor breach, add a seventh: revoke and rotate every key, credential and token that integration held, as Google advised Drift customers.⁴