Defending SaaS-based applications against ShinyHunters OAuth abuse

In this article Attack chain overview Improving visibility into Salesforce OAuth abuse Mitigation and protection guidance Learn more In a series of campaigns observed between mid-2025 and mid-2026, Microsoft identified threat actor activity with overlapping tradecraft commonly associated with ShinyHunters, including voice phishing (vishing), supply chain compromise, and misconfigured guest access to target customer SaaS-based applications such as Salesforce instances.