One Malicious OAuth Approval Can Give Hackers Persistent Access to Salesforce Data

One mistaken approval inside Salesforce can hand attackers a quiet, durable route into a company’s most sensitive customer records.

Recent campaigns tied to tradecraft associated with ShinyHunters show how a trusted application connection, rather than a software flaw, can be turned into a channel for large-scale data theft and continued access.

Microsoft observed the activity from mid-2025 to mid-2026 across organizations in retail, education, manufacturing, and other sectors.

The campaigns use voice phishing, compromised SaaS integrations, and overly broad guest access to reach Salesforce environments, query CRM information, and remove data without the usual signs of a suspicious login.

Microsoft said in a report shared with Cyber Security News (CSN) identified the pattern as abuse of trusted OAuth relationships, a method that lets a connected app act with the permissions granted by the employee who approves it.

That makes the intrusion especially dangerous because attackers can blend into legitimate business workflows.

The impact extends beyond a single account. Once approved, a malicious app can enumerate a victim’s Salesforce instance, make API calls in that user’s name, retain access, and potentially expose credentials that open paths to other cloud services.

Microsoft said the activity was not caused by an inherent Salesforce vulnerability, but by attackers abusing relationships that organizations had already trusted.

One Malicious OAuth Approval Can Give Hackers Persistent Access

Attackers began by calling employees while posing as IT support. They persuaded targets to authorize an attacker-controlled connected application that was made to look like a legitimate Salesforce Data Loader tool.

The consent screen grants the app OAuth scopes, and approval gives it the user’s existing privileges without requiring the attacker to keep asking for a password.

In confirmed cases, that one decision let threat actors list Salesforce instances, search and query records, and maintain persistent CRM access.

Since the resulting API traffic comes through an approved application, routine sign-in monitoring may not recognize it as hostile.

That access can be used to collect accounts, contacts, and service case data, then move toward other SaaS services if usable credentials are found.

The technique removes the need for malware on an employee device or for repeated account takeovers. Instead, it turns a normal authorization step into a long-lived foothold operating under legitimate permissions.

The risk is not confined to the person who clicks Approve. Salesforce data often connects sales, support, partners, and internal business processes, so broad permissions can expose a much larger operational picture.

The central lesson is simple: an OAuth consent prompt is a security decision, not a harmless setup screen, particularly when a caller is directing the process in real time for the employee.

Supply-Chain and Guest Access Risks

Microsoft also documented supply-chain routes involving SaaS vendors whose products connect to Salesforce.

Compromised Salesloft Drift credentials in August 2025 exposed connection secrets that enabled OAuth-token use across customer instances, while a November campaign abused Gainsight-published applications to preserve API access.

A June 2026 Klue incident followed the same broad model. Separately, attackers used Salesforce Aura endpoints where guest-user permissions were incorrectly configured.

By sending GraphQL-based Aura requests and chaining them together, the actors could retrieve far more information than a guest should normally access.

These methods use accepted identities or application pathways, making large data downloads resemble ordinary integration activity.

Organizations should review every connected application, remove or revoke unused approvals, and closely check whether powerful permissions are truly needed.

Microsoft recommends following Salesforce security practices, securing Experience Cloud guest-user access, and proactively monitoring Salesforce event logs.

Security teams should also investigate unusual API volume, report exports, unfamiliar application IDs, new network locations, and guest-user behavior.

Administrators should compare app permissions with real business need and treat dormant integrations as exposure, especially after 90 days of inactivity.

Faster event telemetry can help investigators attribute actions to connected applications and understand which identities, sessions, and API calls were involved.

A careful review of guest access and third-party connections can reduce the chance that trusted access becomes an attacker’s persistence mechanism.

Indicators of compromise (IoCs):-

Type	Indicator	Description
IP address	138.226.246.94	Used by the Klue integration to call the Salesforce API for CRM queries on June 11. Previously disclosed by Klue in its breach notification.
IP address	212.86.125.24	Not specified in source material.
IP address	213.111.148.90	Not specified in source material.
IP address	94.154.32.160	Not specified in source material.
IP address	103.75.11.78	Used to target the Aura framework through guest access from June 19 to 22; identified by Microsoft during a novel campaign.
IP address	103.75.11.110	Used to target the Aura framework through guest access from June 19 to 22; identified by Microsoft during a novel campaign.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Help your security team focus on the that matter most. Use ANY.RUN Threat Intelligence Feeds to automate enrichment and improve detection accuracy.