ShinyHunters Group Exploits SaaS OAuth Trust to Exfiltrate Data Globally

SAN FRANCISCO — A threat actor group linked to ShinyHunters has launched a widespread campaign abusing OAuth trust relationships within major Software-as-a-Service (SaaS) applications, including Salesforce, to exfiltrate sensitive data from organizations across the retail, education, and manufacturing sectors. The attack vector relies on manipulating third-party application permissions rather than traditional credential theft.

The operation, detected globally as of July 13, 2026, leverages a combination of voice phishing, supply chain compromises, and misconfigured guest access settings to establish unauthorized footholds in victim networks. By exploiting the inherent trust between SaaS platforms and authorized third-party integrations, attackers bypassed standard security controls designed to protect against brute-force attacks or stolen passwords.

Security researchers identified that threat actors are using voice phishing campaigns to trick employees into granting excessive permissions to malicious applications disguised as legitimate business tools. Once access is granted via the OAuth protocol, these compromised tokens allow the group to move laterally within cloud environments and extract customer data without triggering standard login alerts. In parallel cases, attackers have infiltrated software supply chains to inject malicious code that automatically requests elevated privileges during application installation.

The campaign specifically targets organizations relying on complex ecosystems of interconnected SaaS tools where guest access policies are often loosely defined. By exploiting these misconfigurations, the group has achieved persistence in targeted environments, maintaining long-term access even after initial detection attempts by internal security teams. The scope of the intrusion spans multiple industries, with confirmed impacts reported from retail chains managing customer databases to educational institutions protecting student records.

The methodology represents a significant shift in how threat actors approach cloud infrastructure, moving away from direct network breaches toward social engineering and protocol abuse. By focusing on the trust relationships established between enterprise applications and external services, ShinyHunters-associated actors have created a pathway for data exfiltration that is difficult to distinguish from legitimate business activity.

As organizations scramble to audit their OAuth configurations and revoke suspicious third-party access tokens, questions remain regarding the full extent of the data compromised. It is unclear how many other SaaS platforms beyond Salesforce are currently being targeted using similar techniques or if the group has expanded its operations into additional sectors such as healthcare or finance. The evolving nature of these supply chain attacks suggests that standard perimeter defenses may be insufficient against threats operating within authorized trust boundaries.