---
title: "The phone call that beat MFA: how ShinyHunters got into Salesforce through OAuth"
summary: "How a year of SaaS data thefts worked: voice calls, approved apps and stolen integration tokens, mid-2025 to 13 July 2026, from Microsoft, Google and the FBI."
url: https://www.thetechbag.com/blog/shinyhunters-salesforce-oauth-phone-call
format: Analysis
desk: "Identity & access"
published: 2026-07-14
facts_checked: 2026-07-14
author: TechBag (The TechBag Journal)
tags: ["ShinyHunters","Salesforce","OAuth","connected apps","vishing","help desk","Salesloft Drift","Gainsight","Klue","MFA","DPDP Rules","CERT-In"]
cover: https://www.thetechbag.com/blog/covers/shinyhunters-salesforce-oauth-phone-call.png
---

# The phone call that beat MFA: how ShinyHunters got into Salesforce through OAuth

*How a year of SaaS data thefts worked: voice calls, approved apps and stolen integration tokens, mid-2025 to 13 July 2026, from Microsoft, Google and the FBI.*

Analysis · Identity & access · By TechBag · Published 2026-07-14 · Facts checked 2026-07-14 · Canonical: https://www.thetechbag.com/blog/shinyhunters-salesforce-oauth-phone-call

The short version

- The largest SaaS data thefts of the past year did not break Salesforce or crack multi-factor authentication. Callers posing as IT support talked staff into approving an attacker’s app, often a fake “Salesforce Data Loader”, and Salesforce then issued that app a token of its own. Microsoft, on 13 July: “not the result of a vulnerability inherent to Salesforce.”[1][3]
- The second door was somebody else’s integration. OAuth tokens stolen from Salesloft Drift (August 2025), Gainsight (November 2025) and Klue (June 2026) opened customers’ Salesforce instances without anyone at those customers being phished.[1][4][5]
- The fix is mostly settings and scripts, not a new product: decide who may approve an app, remove apps unused for 90 days, watch for bulk exports, and make the help desk call back before it resets anything. In India, CERT-In’s six-hour reporting clock applies now; the DPDP Rules’ 72-hour report to the Data Protection Board applies from 13 May 2027.[1][15][17]

On 13 July 2026 Microsoft published a year of intrusions into Salesforce tenants, mid-2025 to mid-2026, by actors with “overlapping tradecraft commonly associated with ShinyHunters”, and named retail, education and manufacturing among the sectors hit.[1] If your company runs Salesforce, HubSpot, Zoho CRM or Microsoft 365, the same mechanism applies to you: an employee can connect a third-party app, and the app then reads data on its own. So the questions are practical. Who in your company can say yes to an app? Would anyone notice if they said yes during a phone call? And which of your vendors holds a standing key to your customer records?

## One call, one code, one approved app

The FBI dates the voice campaign, which Google tracks as UNC6040, to October 2024. The callers phone a company’s call centre or staff posing as IT support, often about a connectivity problem or “an auto-generated ticket”.[3] Google says the group favours the English-speaking branches of multinationals.[2] What follows is a sequence of ordinary-looking steps, and only the last one is visibly criminal.

**Figure: Every step of the call happens on a real login page; the attacker never needs a software flaw**

*The UNC6040 voice-phishing sequence against Salesforce, as described by the FBI and Google, October 2024 to September 2025*

Step 1 of 6

1. The call

A caller posing as IT support says a ticket needs closing or a connection needs fixing, and stays on the line.

Source: FBI FLASH-20250912-001 (12 September 2025); Google Threat Intelligence Group, 5 June 2025 · as of 12 September 2025

“Beat MFA” needs a precise meaning. In step 3 the victim is already signed in; multi-factor authentication has proved who they are, and never asks whether they should hand a key to a stranger’s app. Only step 2, a code read out over the phone, is something MFA could stop, and only a phishing-resistant kind.

ReportedThe FBI's own words

“Authorizing a malicious connected app bypasses many traditional defenses such as MFA, password resets and login monitoring, and because OAuth tokens are issued by Salesforce itself, activity coming from the malicious app can look like it’s from a trusted integration.”[3]

## OAuth consent in plain words: a valet key, not a password

OAuth is how one app gets permission to use another on your behalf without ever seeing your password. Think of a valet key: it starts the car but does not open the boot, and the owner hands it over once. Salesforce calls these permitted apps “connected apps”; an administrator or a sufficiently privileged user approves them.[3] The weakness is in the hand-over, not the key.

**Figure: Once a person approves an app, the app holds its own key and no longer needs that person, their password or their MFA**

*How OAuth app consent works in Salesforce, Microsoft 365 and similar SaaS platforms, as documented to July 2026*

1. 01An app asksIt names what it wants: read contacts, run queries, or “full” access.
2. 02A person says yesA signed-in user or admin approves on the platform’s real page, so nothing looks fake.
3. 03The platform issues a tokenThe app, not the person, now holds an access token and usually a refresh token.
4. 04The app works aloneIt calls the API as that user. A password reset does not end it, and sign-ins may show nothing odd.

Source: FBI FLASH-20250912-001; Microsoft Entra documentation on user consent; Microsoft Security blog, 13 July 2026 · as of 13 July 2026

Microsoft saw exactly that last step: discovery, bulk queries and mass exfiltration of accounts, contacts and service cases, “often without sign-in anomalies.”[1] Most buyers have never looked at who is allowed to approve. In Microsoft Entra, by default, “all users are allowed to consent to applications for permissions that don’t require administrator consent”; Microsoft’s own advice is to allow user consent only for apps from verified publishers.[6] In Salesforce, Google’s advice is to keep the “Manage Connected Apps” and “Customize Application” permissions with trusted admins, and to treat “API Enabled”, which “allows broad data export capabilities”, as a privilege.[2]

Our view

Our view: treat an app approval like a payment. Nobody in finance releases money because a caller is on the line, and nobody should type a connection code because IT phoned. The person approving an app should never be the person talking to whoever asked for it.

## The second door: tokens stolen from somebody else's integration

The phone call needs a gullible employee. The other route needs only a vendor that has already been connected. Between 8 and 18 August 2025 an actor Google tracks as UNC6395 used stolen Salesloft Drift tokens to export Cases, Accounts, Users and Opportunities from “numerous corporate Salesforce instances”, then searched the haul for AWS keys, passwords and Snowflake tokens.[4] Salesloft and Salesforce revoked every Drift token on 20 August.[3] In November Salesforce revoked the tokens of Gainsight-published apps; Gainsight said it had been breached through tokens linked to Drift.[5] One theft fed the next.

**Figure: Each integration breach opened a new set of customer tenants, and one led to the next**

*Disclosures and token revocations in the Salesforce data-theft campaigns, June 2025 to July 2026*

| Date | Event | Detail |
| --- | --- | --- |
| 5 Jun 2025 | Google describes the voice campaign | UNC6040: fake Data Loader approved during IT-support calls |
| 8 Aug 2025 | Drift tokens used | Exports from many Salesforce instances, 8 to 18 August |
| 20 Aug 2025 | All Drift tokens revoked | Salesloft and Salesforce; Drift pulled from AppExchange |
| 12 Sept 2025 | FBI FLASH | Indicators for UNC6040 and UNC6395 |
| 20 Nov 2025 | Gainsight tokens revoked | Gainsight says it was breached via Drift-linked tokens |
| 12 Mar 2026 | Telus Digital confirms a breach | Attackers claim cloud keys found in Drift-stolen data |
| 11 Jun 2026 | Klue-linked activity | Microsoft's indicator date; Salesforce then disables Klue Battlecards |
| 13 Jul 2026 | Microsoft's write-up | A year of intrusions and the defences |

Source: Google GTIG; FBI; BleepingComputer; Microsoft Security blog · as of 13 July 2026 · Dates are of the activity or the disclosure as each source gives it. Telus Digital's entry route is the attackers' claim.

The latest link is Klue, a competitive-intelligence tool. Klue told customers that attackers got into its backend through “a dormant but still active credential created by Klue for a prototype integration” and pushed a code update that stole customers’ OAuth tokens. Huntress confirmed its Salesforce data was taken; Salesforce disabled the Klue Battlecards app; Klue switched off its HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive and Slack integrations too.[8] Attribution is contested: Microsoft names the actor that got into Klue Storm-3138,[1] and BleepingComputer ties the extortion emails to a newer group called “Icarus”, not ShinyHunters.[8] For the buyer it makes no difference. Verizon’s 2026 breach report puts a third party in 48% of breaches.[9]

TechBag countTechBag count

Of the six intrusions dated in this piece, two began with a phone call (Google’s own Salesforce instance in June 2025, and Charter on 1 April 2026 by the attackers’ account) and four with a credential or token taken from another company (Drift, Gainsight, Telus Digital by the attackers’ account, and Klue). None began with a software exploit. We counted each intrusion once, by its first reported entry point; Instructure is left out because its entry point is not reported.

## Who was hit: what victims confirmed, and what the attackers claim

Extortion groups sell on the size of their claims, so the numbers below are in two columns. Google disclosed that its own corporate Salesforce instance was hit in June 2025 by similar activity, losing “basic and largely publicly available business information.”[2] The largest 2026 case is Charter Communications: ShinyHunters says it phoned a Charter employee on 1 April, took over their Microsoft Entra account and exported customer records from Salesforce.[10]

**Figure: The attackers' numbers run far ahead of anything a victim or an independent counter has confirmed**

*Victims of the Salesforce data-theft campaigns: confirmed or independently reported, against attacker claims, August 2025 to June 2026*

Confirmed or independently reported

- Google: its corporate Salesforce instance, June 2025; basic, largely public business data
- Charter: a breach confirmed on 26 May 2026; it says no sensitive personal data or CPNI was taken
- Have I Been Pwned: 4.9 million accounts in the leaked Charter data
- Telus Digital: “unauthorized access to a limited number of our systems”
- Huntress: Salesforce data stolen through Klue, June 2026

Claimed by the attackers, not verified

- About 760 companies and 1.5 billion records from the Drift campaign
- 285 more Salesforce instances reached through Gainsight
- Nearly 1 petabyte from Telus Digital, with a US$65 million demand
- 40 million Charter records, including some CPNI

Source: Google GTIG; BleepingComputer (Gainsight, Telus Digital, Charter, Klue); Have I Been Pwned via BleepingComputer · as of 30 June 2026 · Claims are the attackers' own and were not verified by the reporters. Records and accounts are different units.

Have I Been Pwned counted 4.9 million accounts in the data leaked after Charter refused to pay; Charter said only “sales tools used to manage current, past and prospective Business customers were impacted.”[11] At Instructure, the company behind the Canvas learning platform, BleepingComputer reports several attacks, Canvas outages, data on tens of millions of students, and an “agreement” with the group.[10] The right-hand column was told to BleepingComputer by the attackers; none of it has been confirmed by Salesforce or the companies named.[5][7]

> This activity was not the result of a vulnerability inherent to Salesforce.Microsoft Security, 13 July 2026

## What Microsoft says to do, and what its list leaves out

Microsoft’s defences are specific.[1] Its first is to connect Salesforce to Microsoft Defender for Cloud Apps, which is its own product; read that as one way to do the job, not the only one. Every other step can be done with Salesforce’s own controls, and we have put them in the order we would do them.

**Figure: Most of the defences are settings and procedures you already own; the deep logging is a paid add-on**

*Defences against OAuth app abuse in Salesforce, from Microsoft (13 July 2026), Google GTIG (2025) and the FBI (September 2025)*

Step 1 of 6

1. List every connected app

Find the highly privileged ones and check each integration is one you chose.

Source: Microsoft Security blog, 13 July 2026; Google GTIG, 5 June and 27 August 2025; FBI FLASH-20250912-001 · as of 13 July 2026 · Salesforce Shield Event Monitoring is a paid add-on; Microsoft's alternative is Defender for Cloud Apps.

Steps 1 to 5 come from Microsoft and Google.[1][2][4] Step 6 is the FBI’s.[3] After any vendor breach, add a seventh: revoke and rotate every key, credential and token that integration held, as Google advised Drift customers.[4]

Our view

Our view: phishing-resistant MFA, such as a passkey or a FIDO2 key, stops step 2 of the call, because there is no code to read out. It does not stop step 3, where a signed-in user approves an app. Only step 3 of this list closes that, and a help desk that will not reset or approve anything during the call that asked for it. Buy the keys, but change the approval rules first; that costs nothing.

If you are buying this in India

**No Indian victim is named, which is not the same as none.** Every confirmed case in this piece is American or Canadian, and we found no Indian company publicly linked to these campaigns as of 14 July. The exposure does not depend on where the tenant is: a Salesforce, HubSpot or Zoho CRM instance run from Bengaluru has the same connected-app settings and the same integrations as one in Ohio. The steps in section 5 apply unchanged.

**The help desk may be in India.** Global companies often outsource their service desks, and the impersonation call lands wherever that desk sits. The case to know is Marks & Spencer. Its chairman told British MPs that its April 2025 attack was a “sophisticated impersonation” aimed at a “third-party vendor”, without naming it. Tata Consultancy Services ran M&S’s service desk; TCS told UK lawmakers it found no evidence of compromise in its client networks, and both companies say the end of the service-desk contract in July 2025 was unrelated.[12] Whoever runs your help desk, write the rule into the contract: no password reset, MFA change or app approval on the same call that asks for it, and a call-back to a number already on file.

**The law that bites.** CERT-In’s directions of 28 April 2022 already require a data breach or unauthorised access to be reported within six hours of being noticed.[17] Under the DPDP Act, the company that decides why personal data is processed stays responsible even for processing a vendor does on its behalf, “irrespective of any agreement to the contrary”, and must tell the Data Protection Board and every affected person of a breach.[13] Rule 7 of the DPDP Rules, notified on 13 November 2025, requires a first notice without delay and a detailed report to the Board within 72 hours. It applies from 13 May 2027.[14][15] The Act’s schedule allows penalties of up to ₹250 crore for failing to keep reasonable security safeguards and up to ₹200 crore for failing to report a breach.[16] A Drift-style theft from your CRM is your breach to report, not your vendor’s.

**What it costs.** Steps 1 to 4 cost admin time, not money; step 6 costs training time and, for hardware keys, the keys. Shield Event Monitoring and SaaS security tools are paid add-ons; ask for quotes in INR inclusive of 18% GST, and ask the vendor which of the six steps its tool does that Salesforce cannot already do.

How we did this

Figures as of 14 July 2026

The mechanism is taken from the FBI’s FLASH of 12 September 2025 and Google Threat Intelligence Group’s posts of 5 June and 27 August 2025; the defences and the Klue indicator date from Microsoft’s post of 13 July 2026. Victim facts are from company statements as reported by BleepingComputer, and the Charter account count is Have I Been Pwned’s. Attacker figures are labelled as claims and not added together. The count of entry points is ours, one per intrusion, by the first reported route; Instructure is excluded because its route is not reported. Microsoft gives no victim or record counts. Only sources published on or before 14 July 2026 are used.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Microsoft Security blog, Defending SaaS-based applications against ShinyHunters OAuth abuse](https://www.microsoft.com/en-us/security/blog/2026/07/13/defending-saas-based-applications-against-shinyhunters-oauth-abuse/) — 13 July 2026
2. [Google Threat Intelligence Group, The cost of a call: from voice phishing to data extortion (UNC6040)](https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion) — 5 June 2025, updated 5 and 8 August 2025
3. [FBI, FLASH-20250912-001: UNC6040 and UNC6395 compromising Salesforce instances for data theft and extortion](https://www.ic3.gov/CSA/2025/250912.pdf) — 12 September 2025
4. [Google Threat Intelligence Group, Widespread data theft targets Salesforce instances via Salesloft Drift (UNC6395)](https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift) — 27 August 2025, updated 28 August
5. [BleepingComputer, Salesforce investigates customer data theft via Gainsight breach](https://www.bleepingcomputer.com/news/security/salesforce-investigates-customer-data-theft-via-gainsight-breach/) — 20 November 2025, updated 21 November
6. [Microsoft Learn, Configure how users consent to applications (Microsoft Entra ID)](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent) — 15 June 2025
7. [BleepingComputer, Telus Digital confirms breach after hacker claims 1 petabyte data theft](https://www.bleepingcomputer.com/news/security/telus-digital-confirms-breach-after-hacker-claims-1-petabyte-data-theft/) — 12 March 2026
8. [BleepingComputer, Klue OAuth breach linked to Icarus Salesforce data theft attacks](https://www.bleepingcomputer.com/news/security/klue-oauth-breach-linked-to-icarus-salesforce-data-theft-attacks/) — 18 June 2026
9. [Help Net Security, Lessons from the Verizon DBIR 2026 findings (third parties in 48% of breaches)](https://www.helpnetsecurity.com/2026/05/25/lessons-from-verizon-dbir-2026-findings/) — 25 May 2026
10. [BleepingComputer, Charter confirms data breach after ShinyHunters extortion threat](https://www.bleepingcomputer.com/news/security/charter-confirms-data-breach-after-shinyhunters-extortion-threat/) — 26 May 2026
11. [BleepingComputer, Charter Communications data breach affects 4.9 million accounts](https://www.bleepingcomputer.com/news/security/charter-communications-data-breach-affects-49-million-accounts/) — 29 May 2026, updated 30 May
12. [People Matters, TCS denies cyberattack link as Marks & Spencer ends IT service desk contract](https://www.peoplematters.in/amp/news/business/tcs-denies-cyberattack-link-as-marks-and-spencer-ends-it-service-desk-contract-46960) — 27 October 2025
13. [Digital Personal Data Protection Act, 2023, section 8 (duties of a Data Fiduciary, including processing by a Data Processor)](https://dpdpa.com/dpdpa2023/chapter-2/section8.html) — 11 August 2023
14. [Digital Personal Data Protection Rules, 2025, Rule 7 (intimation of personal data breach)](https://dpdpa.com/dpdparules/rule7.html) — notified 13 November 2025
15. [DPDP Rules, 2025, commencement timeline (Rules 6 and 7 from 13 May 2027)](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025
16. [Digital Personal Data Protection Act, 2023, the Schedule (penalties)](https://dpdpa.com/theschedule.html) — 11 August 2023
17. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [IAM, SSO and MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — phishing-resistant MFA and the consent controls that stop step 2
- [Identity governance guide](https://www.thetechbag.com/browse/identity-access/identity-governance) — regular reviews of who and what holds access, connected apps included
- [Salesforce vendor hub](https://www.thetechbag.com/salesforce) — the platform whose connected-app settings this piece is about