Topic starter
16/01/2026 3:16 pm
TL;DR: June and July 2025 Salesforce intrusions used voice phishing plus malicious OAuth Connected Apps to bypass MFA and export CRM data from dozens of organisations, with disclosed victims including Google, Qantas, Allianz Life, LVMH/Chanel, and Workday, according to Obsidian Security. The incident shows that token abuse and consent manipulation can turn routine SaaS access into large-scale NHI exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “ShinyHunters and Scattered Spider: A Merger of Chaos in the 2025 Salesforce Attacks”.
Key questions
Q: What breaks when an OAuth-connected app is compromised in Salesforce?
A: When a Salesforce-connected app is compromised, the token becomes a trusted identity that can query data, export records, and search for embedded secrets without bypassing MFA.
Q: Why do OAuth tokens increase the impact of voice phishing?
A: OAuth tokens convert a one-time social engineering success into reusable API authority.
Q: What signals show that mobile app governance is failing?
A: A common signal is high confidence paired with continued incidents or unexplained exposure.
Practitioner guidance
- Tighten connected-app approval rules Require explicit review for new OAuth Connected Apps, especially those requesting broad Salesforce scopes or offline access.
- Revoke and audit dormant tokens Search for unused, long-lived, or suspicious OAuth tokens and revoke them as part of a standing hygiene cycle.
- Monitor API export behaviour Alert on large CRM exports, unusual query patterns, and new user-agent or ASN combinations that do not match normal business usage.
Bottom line: The Salesforce attacks show that social engineering can become a scalable SaaS intrusion method when it is paired with malicious OAuth consent.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:56 pm
Consent is the new trust boundary: This campaign shows that the security decision moved from password entry to app authorization. The attacker did not need to beat Salesforce authentication if they could persuade a user to approve a malicious connected app. That means SaaS governance now has to control what users are allowed to delegate, not only who they are.
A question worth separating out:
Q: How should organisations reduce Salesforce CRM data theft risk?
A: Organisations should treat Salesforce as a governed access surface, not only a business application. That means restricting who can authorise connected apps, reviewing token scope regularly, monitoring API exports, and training help desk and end users on consent phishing. The goal is to make delegated access harder to obtain and easier to revoke.
👉 Read our full editorial: Salesforce OAuth abuse shows how social engineering scales NHI risk