![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/07\/1783988409_676_image-5.webp\")
Figure 1. Commonly observed attack paths for SaaS applications.<\/p>\n
Observed activity can be grouped into three primary intrusion paths:<\/p>\n
Voice\u2011phishing-driven OAuth consent abuse<\/p>\n
In campaigns beginning in mid-2025, the threat actors conducted vishing attacks impersonating IT support personnel.\u00a0Threat actors socially engineered employees into authorizing attacker-controlled connected apps within their Salesforce tenant. In several confirmed cases, threat actors guided users through the OAuth consent workflow to grant access to a malicious application disguised as a legitimate Salesforce Data Loader tool. After users granted consent, these highly privileged OAuth applications enabled threat actors to perform API calls on behalf of the victim user, facilitating:<\/p>\n
Enumeration of Salesforce instances belonging to targeted organizations<\/p>\n
Persistent access to Salesforce CRM data<\/p>\n
Possible lateral movement into other SaaS platforms through discovered credentials<\/p>\n
This intrusion path exploits the OAuth authorization flow of trusted SaaS services rather than relying on malware or credential replay. Threat actors exfiltrate data through sanctioned application access inherited from user privileges.<\/p>\n
SaaS supply\u2011chain compromise targeting trusted integrations<\/p>\n
Following initial access campaigns, threat actors\u00a0 escalated into supply\u2011chain-driven attacks targeting third\u2011party SaaS vendors offering popular solutions that integrate with Salesforce, often using OAuth tokens. In August 2025, compromised Salesloft Drift credentials<\/a> enabled attackers to obtain connection secrets used by downstream SaaS applications, enabling the use of OAuth tokens in multiple customer Salesforce instances.<\/p>\n A subsequent campaign<\/a> in November 2025 targeted Gainsight-published applications integrated with Salesforce, allowing attackers to leverage trusted external connections to maintain persistent API access in multiple Salesforce customer instances. These activities often appeared indistinguishable from legitimate integration behavior. Threat actors performed discovery, bulk data queries, and mass exfiltration of sensitive CRM records, including accounts, contacts, and service case data, without generating traditional sign-in anomalies. Guest access used for exfiltration<\/p>\n Over recent months, Microsoft observed an increase in suspicious guest-user activity targeting Salesforce Aura endpoints across multiple organizations. In these incidents, threat actors leveraged unauthenticated access to Aura framework functionality and used GraphQL-based Aura requests to systematically query and retrieve data. While the activity did not exploit a software vulnerability, it took advantage of misconfigured guest-user permissions to gain unauthorized access to data. By chaining Aura requests and leveraging GraphQL queries, the actors were able to circumvent standard record-retrieval limitations and extract significantly larger volumes of data than would typically be accessible to guest users. All three intrusion paths relied on inheriting trusted application or user privileges, making malicious activity difficult to distinguish from normal operations. The resulting quiet persistence and large-scale data access highlight the need for stronger detection, visibility, and governance of OAuth-connected applications and guest user accounts.<\/p>\n Improving visibility into Salesforce OAuth abuse<\/p>\n For customers using Salesforce Shield: Event Monitoring<\/a>, the upgraded\u00a0Microsoft Defender for Cloud Apps Salesforce connector<\/a> onboards the Real-Time Event Monitoring (RTEM) framework, enabling faster detection and investigation of Salesforce-based attacks.<\/p>\n Investigations into these campaigns exposed a recurring challenge for security teams: malicious activity often appeared indistinguishable from legitimate Salesforce usage because threat actors operated through trusted identities, approved OAuth applications, and authorized integrations. Traditional authentication-focused detections frequently provided limited visibility into the resulting application activity.<\/p>\n To improve investigation and detection of these scenarios, Microsoft expanded Salesforce visibility in Defender for Cloud Apps through additional event telemetry, connected application attribution, and enhanced application permissions insights. These capabilities help security teams identify suspicious OAuth activity, investigate potentially compromised integrations, and better understand how access was obtained and used within customer Salesforce instances.<\/p>\n Key capabilities include:<\/p>\n Near-real-time visibility into Salesforce security and activity events.<\/p>\n Connected application attribution, including application identity and granted OAuth scopes.<\/p>\n Expanded identity, session, and API activity context to support investigations.<\/p>\n Improved correlation within Microsoft Defender to help identify suspicious activity spanning identities, applications, and SaaS environments.<\/p>\n Together with Salesforce Shield: Event Monitoring, these capabilities help security teams investigate suspicious OAuth activity, validate the legitimacy of connected applications, and better understand the potential impact of a compromise.<\/p>\n New posture and governance capabilities for connected OAuth apps<\/p>\n While improved detection is critical, recent incidents have also highlighted the need for stronger preventive controls and ongoing governance of OAuth-connected applications. To address this, Microsoft Defender introduces new posture capabilities for connected and external client apps in Salesforce. Security teams can gain visibility into each OAuth app and its non-human identity, prioritize risk, and reduce the attack surface.<\/p>\n Deep visibility into app permissions and access<\/p>\n Microsoft Defender provides comprehensive visibility into all Salesforce-integrated connected and external client apps, including granted OAuth scopes and privileges.<\/p>\n Highly privileged apps<\/p>\n Security teams often struggle to identify applications with powerful administrative or sensitive permissions. The highly privileged apps insight highlights applications that have been granted elevated scopes, enabling quick identification of apps that may pose significant risk.<\/p>\n Additionally, security teams can use permission-based filters to identify apps with specific high-risk scopes and validate whether such access is justified.<\/p>\n Unused apps<\/p>\n Organizations often create applications for temporary or one-time use, but those applications are rarely removed afterward. These unused apps continue to retain permissions, creating unnecessary exposure. With the recent changes, Defender now allows security teams to identify applications that have been inactive for extended periods (for example, 90 days or more), making it easy to review and revoke access where appropriate to reduce the attack surface.<\/p>\n Risk-based prioritization of connected apps<\/p>\n To further streamline investigation and response, Defender introduces a comprehensive risk scoring model for connected applications. Each application is assigned a numerical risk score [0-100] based on multiple risk indicators, such as usage patterns, permission sensitivity, and behavioral signals. This allows security teams to prioritize efforts effectively and focus on applications that require immediate attention. Security teams can create custom policies based on risk thresholds to trigger alerts, actions, and notifications.<\/p>\n Risk score investigation<\/p>\n To further investigate the specific Non-Human identity risk details, the factors contributing to the risk score are available in Non-Human Identities Risk score tab.<\/p>\n Mitigation and protection guidance<\/p>\n Microsoft\u00a0recommends the following mitigations to reduce the impact of this threat. Check the recommendations card for the deployment status of\u00a0monitored\u00a0mitigations.\u00a0\u00a0<\/p>\n Microsoft Defender detections<\/p>\n Microsoft Defender customers can refer to the list of applicable detections including new detections powered by the upgraded Microsoft Defender for Cloud Apps Salesforce connector. Microsoft Defender coordinates detection, prevention, investigation, and response for endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog.<\/p>\n Customers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender<\/a> to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence.<\/p>\n Tactic\u00a0Observed activity\u00a0Microsoft Defender coverage\u00a0Initial AccessA user\u2019s Salesforce session was hijacked and usedSalesforce detected a possibly hijacked user sessionCredential AccessA user was the target of credential stuffing activitySalesforce detected a successful credential stuffing attackLateral MovementA user with a very high risk score is signing into Salesforce via SSOSalesforce SSO sign-in by high-risk userCollection \/ ExfiltrationAPI-heavy access, report export, and scraping patterns; potential multi-SaaS expansion depending on victim footprint.\u2013 Possible Salesforce scraping activity Threat intelligence reports\u00a0<\/p>\n Microsoft customers can use the following reports in Microsoft products to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this blog. These reports provide intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer Salesforce instances.<\/p>\n Advanced hunting<\/p>\n NOTE:\u00a0The sample queries let you search one week of events. To inspect events and hunt for threat actor-related indicators over a longer period, go to the\u00a0Advanced Hunting\u00a0page >\u00a0Query\u00a0tab, and use the calendar dropdown to set the time range to\u00a0Last 30 days (the maximum for raw data). <\/p>\n Hunt for Salesforce connected-app activity from suspicious infrastructure<\/p>\n CloudAppEvents Hunt for API activity associated with connected apps and relevant user ids<\/p>\n CloudAppEvents Hunt for anomalous report export \/ large data access<\/p>\n CloudAppEvents Pivot from a suspicious connected app (name\/id) to impacted users and actions<\/p>\n CloudAppEvents Audit queries to verify what objects users are accessing<\/p>\n CloudAppEvents Hunt for users with very high Defender risk score signing into Salesforce<\/p>\n let VeryRiskyUsers = IdentityInfo Indicators of compromise (IOC)<\/p>\n Indicator\u00a0\u00a0Type\u00a0\u00a0Description\u00a0\u00a0138.226.246.94\u00a0IP address\u00a0Used by the Klue integration to call Salesforce API to perform CRM queries\u00a0on June 11. Previously disclosed by Klue in their notification about the breach.212.86.125.24\u00a0IP address\u00a0213.111.148.90\u00a0IP address\u00a094.154.32.160\u00a0IP address\u00a0103.75.11.78IP addressUsed to target the Aura framework with guest access from June 19 to 22. These IP addresses were not previously published and were discovered by Microsoft as part of a novel campaign.103.75.11.110IP address<\/p>\n MITRE ATT&CK techniques observed<\/p>\n Initial Access<\/p>\n T1566.004 Phishing: Voice Phishing: Impersonating IT support to get victims to grant access.<\/p>\n T1528 Steal Application Access Token: Using stolen OAuth tokens from Salesloft and Gainsight.<\/p>\n Persistence<\/p>\n T1671 Cloud Application Integration: Leveraging Connected Apps for access to a customer Salesforce environment.<\/p>\n Collection<\/p>\n T1213.004 Data from Information Repositories: Customer Relationship Management Software: Stealing data from a customer Salesforce environment.<\/p>\n Exfiltration<\/p>\n T1567 Exfiltration Over Web Service: Usage of the fake Data Loader application to steal data.<\/p>\n This research is provided by Microsoft Defender Security Research, Shruti Ranjit,\u00a0Doug Cranston, Anand Deshpande, Ronen Rafaeli, and\u00a0with contributions from members of Microsoft Threat Intelligence.<\/p>\n Learn more<\/p>\n For the latest security research from the Microsoft Threat Intelligence community, check out the\u00a0Microsoft Threat Intelligence Blog<\/a>.<\/p>\n To get notified about new publications and to join discussions on social media, follow us on\u00a0LinkedIn<\/a>,\u00a0X (formerly Twitter)<\/a>, and\u00a0Bluesky<\/a>.<\/p>\n
More recently, in June 2026, the market intelligence platform Klue experienced an incident<\/a> where a threat actor, Storm-3138, gained access to its system.\u00a0 Credentials used to access Salesforce customer instances were used in the same fashion, to discover, query, and exfiltrate data.<\/p>\n![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/07\/1783988409_461_image-6.webp\")
Figure 2. Complete permission visibility for Salesforce connected apps and external client apps.<\/p>\n![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/07\/1783988409_712_image-7.webp\")
Figure 3. Identity inventory to identify highly privileged Salesforce apps.<\/p>\n![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/07\/image-8.webp\")
Figure 4. Identity inventory to discover unused Salesforce apps.<\/p>\n![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/07\/1783988410_880_image-9.webp\")
Figure 5. Use actionable insights to identify apps exceeding a defined risk threshold.<\/p>\n![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/07\/image-10.webp\")
Figure 6. Detailed risk insights explaining factors contributing to the risk score.<\/p>\n
\u2013 Salesforce detected a user performing anomalous API activity
\u2013 Salesforce detected a user performing anomalous report activityCollection \/ ExfiltrationAnomalous behavior from Salesforce Connected Apps\u2013 Salesforce Connected App activity from a new IP address
\u2013 Salesforce Connected App activity involving new
\u2013 Salesforce entity Salesforce Connected App activity involving new endpoint(s)Collection \/ ExfiltrationGuest user activity associated with the AuraInspector frameworkSuspicious Salesforce Aura ActivityCollection \/ ExfiltrationAnomalous behavior from a guest userSalesforce detected a guest user performing anomalous activity<\/p>\n
\n| where Application == “Salesforce”
\n| where ActionType in (“ApiTotalUsage”, “API Event”)
\n| extend ConnectedAppId = tostring(
\n coalesce(
\n RawEventData.CONNECTED_APP_ID, \/\/ from ApiTotalUsage
\n RawEventData.ConnectedAppId \/\/ from API Event
\n )
\n)
\n| where isnotempty(ConnectedAppId)
\n| where array_length(UncommonForUser) > 0 \/\/ at least 1 attribute is flagged as uncommon<\/p>\n
\n| where Application == “Salesforce”
\n| where ActionType in (“ApiTotalUsage”, “API Event”)
\n| extend SalesforceUserId=coalesce(tostring(RawEventData.USER_ID), tostring(RawEventData.UserId))
\n| extend ConnectedAppName=tostring(RawEventData.CONNECTED_APP_NAME) \/\/ Connected App Name is not available on the ApiEvent event
\n| summarize count() by AccountObjectId, AccountId, AccountDisplayName, SalesforceUserId, IPAddress, UserAgent, ConnectedAppName<\/p>\n
\n| where Application == “Salesforce”
\n| where ActionType == “ReportExport”
\n| extend SalesforceUserId = tostring(RawEventData.USER_ID)
\n| summarize Events=count() by AccountObjectId, AccountId, AccountName, SalesforceUserId, IPAddress, UserAgent<\/p>\n
\n| where Application == “Salesforce”
\n| where RawEventData has “”
\n| project Timestamp, AccountId, AccountDisplayName, ActionType, IPAddress, UserAgent, RawEventData
\n| order by Timestamp desc<\/p>\n
\n| where Application == “Salesforce”
\n| where ActionType == “UniqueQuery”
\n| extend
\n QueryText = tostring(RawEventData.QUERY_IDENTIFIER), \/\/ Full query text
\n QueryObject = extract(@”(?i)\\bfrom\\s+([^\\s]+)”, 1, tostring(RawEventData.QUERY_IDENTIFIER)), \/\/ Extract just the target object
\n SalesforceUserId = tostring(RawEventData.USER_ID)
\n| where QueryText != “SOQL”
\n| project Timestamp, AccountDisplayName, SalesforceUserId, QueryObject, QueryText<\/p>\n
\n| where DefenderRiskScoreNumber >= 90
\n| distinct AccountObjectId
\nCloudAppEvents
\n| where Application == “Salesforce”
\n| where ActionType has “sso” or ActionType has “saml”
\n| where AccountObjectId in (VeryRiskyUsers)
\n| project Timestamp, AccountObjectId, AccountDisplayName, ActionType, UserAgent
\n| order by Timestamp desc<\/p>\n