ShinyHunters Exploit OAuth Trust to Penetrate Salesforce Without Platform Flaws

Attackers whose methods line up with the data‑extortion group ShinyHunters have spent the past year walking into corporate Salesforce environments without exploiting a single flaw in the platform. The way in has been the trust the organization had already extended, usually through the OAuth connections that tie Salesforce to the apps and third‑party vendors around it. By abusing the OAuth trust chain, the attackers gain access to sensitive data and can demand extortion payments. The infiltration has occurred across multiple industries, and the attackers have leveraged the OAuth permissions to move laterally within the org. Salesforce has issued guidance on tightening OAuth scopes and reviewing connected apps. Security teams should audit all connected apps, revoke unnecessary permissions, and monitor for anomalous activity. The incident underscores the importance of least‑privilege access and continuous monitoring for OAuth‑based attacks.