The most productive breach pattern of 2026 does not break multifactor authentication. It convinces your own employees to hand the attacker an authorized session. Through June and July, the ShinyHunters extortion group, tracked by Google's Mandiant as UNC6240, has breached more than 40 organizations this year using a three-part playbook, and on July 13 Microsoft published an analysis mapping roughly a year of it (Microsoft Security Blog, Jul 13, 2026; The Hacker News, Jul 2026). The victims are not small: Charter Communications had about 4.9 million customer records exfiltrated from Salesforce after a single voice-phished employee's Microsoft Entra account was compromised, and Carnival saw roughly 6 million customers exposed through similar social engineering (TechCrunch, Jul 7, 2026).
The playbook, in three moves
Microsoft's write-up maps three attack paths into Salesforce environments (Microsoft Security Blog, Jul 13, 2026):
- Voice-phishing ("vishing") employees for SSO credentials: a phone call to a help desk or an employee, impersonating IT, walking the target through a login that captures the session.
- Abusing misconfigured Experience Cloud portals: public-facing Salesforce communities left with over-permissive guest access.
- The signature move: tricking users into authorizing an attacker-controlled OAuth "connected app" disguised as Salesforce's own Data Loader. The employee sees a familiar-looking consent screen, clicks approve, and the attacker now holds a legitimate, MFA-blessed token that survives password resets.
Notice what is absent: no zero-day, no malware on the endpoint, no cracked hash. Every step rides authorized functionality. That is why this pattern defeats security stacks that were purchased specifically to stop intrusions. There is no intrusion in the classic sense. The system worked as configured. The configuration was the vulnerability.
Why the defense is governance, not a product
The controls that break this playbook are administrative settings and procedures, which is both the good news and the reason they are neglected: nobody's budget line item says "OAuth governance."
For a mid-market Salesforce shop, the core set is deployable in roughly a week:
- Move connected apps to an admin-approved allowlist. If an app is not on the list, a user cannot authorize it, and the fake Data Loader consent screen dead-ends.
- Disable end-user self-authorization of new connected apps entirely. Legitimate integrations go through an admin request; the one-week cost is a mild inconvenience, the benefit is closing the campaign's best door.
- Audit existing OAuth grants and revoke what nobody recognizes. Attacker tokens already issued survive every other fix.
- Review Experience Cloud guest-user permissions against Salesforce's own hardening guidance; the second path in Microsoft's mapping is pure misconfiguration.
- Write a hard help-desk verification script: no credential action, reset, or MFA change on the strength of an inbound phone call, ever, without an out-of-band callback to a number on file. Vishing works because the help desk improvises; scripts do not improvise.
None of these requires a purchase order. All of them require someone senior deciding the inconvenience is worth it, which is why the pattern keeps working at companies with eight-figure security budgets and no OAuth allowlist.
The honest caveats
Two things we cannot tell you. First, whether your particular SaaS estate has equivalent consent-phishing paths outside Salesforce. The same OAuth logic applies to Microsoft 365 and Google Workspace, and Microsoft's guidance gestures the same direction, but each platform's controls differ in the details. Second, whether ShinyHunters' victim count is complete; extortion groups publicize selectively, and the 40+ figure is what has surfaced, not necessarily what exists.
What we can tell you: this is the rare threat where the complete, vendor-documented defense costs approximately one admin-week. If your CRM holds millions of customer records and end users can still authorize arbitrary connected apps, that gap is now the best-documented open door in your company. Close it before the next campaign cycle finds it.