Home / Technology / Microsoft Boosts Security After Salesforce Breach
Microsoft Boosts Security After Salesforce Breach
14 Jul
Summary
- ShinyHunters exploited Salesforce OAuth trust for data theft.
- Attackers accessed hundreds of customer environments via APIs.
- Microsoft enhanced Defender for Cloud Apps to counter attacks.
The ShinyHunters cybercrime group executed a sophisticated year-long campaign targeting corporate Salesforce environments. Initially, they impersonated IT support to trick users into authorizing a fake Salesforce Data Loader application, gaining access through compromised OAuth permissions.
The group later evolved its tactics by compromising third-party SaaS providers integrated with Salesforce, such as Salesloft, Drift, and Gainsight. This allowed them to steal OAuth tokens and integration secrets, providing access to hundreds of downstream customer Salesforce environments without direct interaction.
Reports indicated up to 700 organizations may have been impacted by this activity. Microsoft, in collaboration with Salesforce, has since upgraded Microsoft Defender for Cloud Apps. These enhancements focus on improving visibility into OAuth-connected applications, strengthening governance over third-party integrations, and enabling near-real-time detection of suspicious activities.
