> TritonInfoSec News
Home / Jul 15, 2026 / Story
0
#6 The Hacker News general July 14, 2026 at 06:19 UTC

Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths

By [email protected] (The Hacker News)

AI Summary

Microsoft has mapped a year-long Salesforce data theft campaign by actors whose TTPs align with ShinyHunters, conducted entirely through abuse of OAuth trust relationships rather than Salesforce platform vulnerabilities. Attackers exploited OAuth connections between Salesforce and third-party integrations across three distinct attack paths, allowing persistent access to corporate data without triggering platform-level alerts. This highlights the risk of implicit trust granted to OAuth-connected third-party applications in enterprise SaaS environments.

Read full article → https://thehackernews.com/2026/07/microsoft-maps-y…

Relevance score: 84.0/100

# More from July 15

  1. 1
    Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack The Hacker News
  2. 2
    SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now BleepingComputer
  3. 3
    11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot The Hacker News
  4. 4
    SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data The Hacker News
  5. 5
    OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials The Hacker News
  6. 7
    Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown BleepingComputer
  7. 8
    U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support The Hacker News
  8. 9
    US unseals indictment against alleged operators of Russian bulletproof hosting service The Record
  9. 10
    Multiple Jscrambler Packages Impacted by Supply Chain Attack SecurityWeek