[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6rqqO6eucQWr0nedctbE6tfjWoQEGuSVHsTDg3psEbM":3},{"article":4,"iocs":56,"watch_terms":60,"solutions":61,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"9c6fa72e-bb66-405c-8129-eefdcf50d974","Defending SaaS-based applications against ShinyHunters OAuth abuse","defending-saas-based-applications-against-shinyhunters-oauth-abuse-8650d9","Microsoft Threat Intelligence identified threat actor activity with overlapping tradecraft commonly associated with ShinyHunters, including voice phishing (vishing), supply-chain compromise, and misconfigured guest access targeting SaaS-based applications. The post Defending SaaS-based applications against ShinyHunters OAuth abuse appeared first on Microsoft Security Blog.","Microsoft Threat Intelligence has identified threat actor activity, linked to ShinyHunters, targeting SaaS applications like Salesforce. The attackers exploit OAuth consent, supply chain integrations (e.g., Salesloft, Gainsight), and misconfigured guest access to gain unauthorized access, exfiltrate data, and maintain persistence. This tradecraft bypasses conventional authentication methods by abusing trusted relationships within legitimate workflows.","ShinyHunters abuses OAuth and supply chain to target SaaS apps like Salesforce.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F07\u002F13\u002Fdefending-saas-based-applications-against-shinyhunters-oauth-abuse\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F05\u002FMS_Actional-Insights_Links.jpg","2026-07-13T22:02:41+00:00","2026-07-14T00:00:24.827175+00:00",8,[17,20,23,25,27,30],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":22},"Salesforce","product",{"name":24,"type":22},"Salesloft",{"name":26,"type":22},"Gainsight",{"name":28,"type":29},"OAuth","technology",{"name":31,"type":32},"Voice-phishing-driven OAuth consent abuse","campaign","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":55},{"id":33,"icon":35,"name":36,"slug":37},[57],{"type":58,"value":18,"context":59},"malware","Threat actor group associated with the observed tradecraft.",[21,24,26],{"controls":62,"vendors":144},[63,92,118],{"slug":64,"name":65,"problem":66,"products":67},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":93,"name":94,"problem":95,"products":96},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":114,"product_name":115,"url":116,"description":117},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":119,"name":120,"problem":121,"products":122},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[123,130,136],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":125,"url":128,"description":129},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":131,"product_name":132,"url":134,"description":135},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",[145],{"slug":69,"name":70,"logo_path":71,"roles":146},[147],"reported_by",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":169},"shinyhunters-abuses-oauth-and-supply-chain-integrations-to-compromise-saas-environments","ShinyHunters Abuses OAuth and Supply Chain Integrations to Compromise SaaS Environments","ShinyHunters exploited OAuth consent flows and misconfigured guest access within SaaS platforms like Salesforce, leveraging trusted third-party integrations (e.g., Salesloft, Gainsight) as entry points. Because these integrations operate within legitimate workflows, traditional authentication controls failed to flag the malicious activity. The attack highlights how implicit trust granted to SaaS-to-SaaS integrations creates a shadow attack surface that most organizations do not actively govern. Overpermissioned OAuth grants and poorly scoped guest accounts amplified the blast radius, enabling data exfiltration and persistent access. This matters because SaaS sprawl continues to grow, and each unreviewed integration represents a potential standing access path for adversaries.",[153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","CIS Control 16 – Application Software Security","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SR-6 – Supplier Assessments and Reviews","NIST CSF ID.AM-3 – Organizational Communication and Data Flows Mapped","GDPR Article 32 – Security of Processing","GDPR Article 28 – Processor Obligations (supply chain accountability)","ISO\u002FIEC 27001 A.9.4 – System and Application Access Control","ISO\u002FIEC 27001 A.15.1 – Information Security in Supplier Relationships","MITRE ATT&CK T1550.001 – Use Alternate Authentication Material: Application Access Token","MITRE ATT&CK T1195 – Supply Chain Compromise",{}]