ShinyHunters Salesforce and SaaS token campaign, mid-2025 to mid-2026

What happened

• Microsoft (13 Jul 2026) identifies three paths: vishing to get malicious connected apps approved, OAuth tokens stolen from vendors, and misconfigured Experience Cloud guest access.
• 2026 examples: Klue (Storm-3138, Jun 2026, legacy integration credential) and Anodot (stolen tokens reused against 13+ customers, per secondary sources).

Sources

• https://rhisac.org/threat-intelligence/shinyhunters-abusing-oauth-to-compromise-saas-apps/
• https://www.picussecurity.com/resource/blog/the-shinyhunters-domino-effect-one-breach-hundreds-of-victims

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.