EXECUTIVE SUMMARY
The attack that defines enterprise security in 2026 does not begin with a zero-day exploit. It begins with a stolen token, a trusted integration, and a threat actor who understood your SaaS architecture better than your own security team did.
The Salesloft-Drift campaign of August 2025 compromised over 700 organizations by exploiting OAuth tokens from a single trusted third-party integration, accessing Salesforce environments without triggering a single MFA prompt. ¹
By November 2025, Gainsight fell the same way, adding another 200+ Salesforce instances to the victim list. ² By April 2026, ShinyHunters had compromised Rockstar Games through a third-party analytics vendor’s Snowflake credentials. ³
The pattern is not evolving. It is repeating, at scale, against organizations that keep assuming someone else is watching the SaaS layer.
SECTION 1: THE ARCHITECTURE OF TRUST THAT BECAME AN ATTACK SURFACE
1.1 How the SaaS Ecosystem Became the New Perimeter
Every department in a modern enterprise runs on SaaS. Sales in Salesforce. Engineering in GitHub. HR in Workday. Finance in NetSuite. Each platform connects to several others through OAuth integrations, API keys, and service accounts, creating an invisible web of delegated trust that most security teams have never fully mapped.
Enterprises now manage an average of 490 cloud applications as of 2025, many unsanctioned or incompletely governed. ⁴
Every application carries OAuth tokens granting access to data inside other platforms. Every token is a potential entry point. Microsoft’s 2025 Digital Defense Report was direct: identity-based attacks are now the number one initial access vector in enterprise breaches, surpassing traditional network exploits as of 2025. ⁵ The perimeter is gone. The identity layer is what remains.
1.2 The Token Problem Most Teams Have Not Solved
An OAuth token is not a password. It bypasses MFA by design because the MFA challenge was completed at authorization, not at use. A threat actor with a valid OAuth token can act with full user-level permissions across every connected platform, silently, for as long as the token remains valid.
Initial compromise of Salesloft’s GitHub occurred in March 2025. Stolen Drift OAuth tokens persisted through August 2025, enabling ten days of active data exfiltration across 700+ downstream organizations before detection. ⁶
One compromised integration, undetected for five months, became the master key to hundreds of enterprise environments. The blast radius of a single supply chain token theft is ten times greater than a direct platform compromise, per Obsidian Security’s February 2026 analysis. ⁶
SECTION 2: THE SHINYHUNTERS PLAYBOOK – OPERATIONAL ANALYSIS
ShinyHunters is not a nation-state actor. It is a financially motivated cybercriminal group that has turned SaaS breach methodology into a repeatable franchise model. ⁷ The same four steps appear in every campaign.
(Sources: As per references shown above, Cyber Tech Intelligence Analysis)
2.1 Step One: Social Engineering the Initial Foothold
ShinyHunters rarely hacks its way in. It talks its way in. Voice phishing directed at SSO account holders or IT helpdesks is the consistent entry method. In the March 2026 Aura breach, one vishing call gave attackers access to an employee account for approximately one hour, exposing 900,000 customer records before detection. ⁸
That a company selling identity protection was breached through identity compromise is not ironic. It is instructive. No firewall stops a convincing phone call. No EDR flags it. No SIEM alert fires.
2.2 Step Two: Owning the SSO Account, Then Everything Connected to It
Once ShinyHunters has SSO credentials, the entire connected SaaS ecosystem becomes accessible. In Panera’s case, a Microsoft Entra SSO compromise granted access to every connected application. In the March 2026 TELUS Digital breach, the group claimed over one petabyte of data through SSO-connected environments. ⁷
SSO was designed to reduce authentication friction. That same design, when compromised, becomes a single point of catastrophic failure.
2.3 Step Three: Harvesting Secrets from Breached Environments
Every breached environment is searched for additional credentials: AWS access keys, Snowflake passwords, refresh tokens, anything that extends access to separate systems.
In the Salesloft-Drift campaign beginning March 2025, attackers used TruffleHog to identify stored credentials within Salesloft’s GitHub before exploiting stolen Drift OAuth tokens. ⁹ Each breach is not an endpoint. It is a reconnaissance operation for the next one.
2.4 Step Four: Extortion, or the Data Goes Public
ShinyHunters does not encrypt files. Its leverage is exposure. In March 2026, the group claimed Salesforce-linked data from more than 400 companies and published data from 26 of them as proof. ³
Rockstar Games received its notice in April 2026: “Your Snowflake instances were compromised thanks to Anodot.com. Pay or leak.” ¹⁰ Unlike ransomware, there is no decryption key to negotiate. The data is already gone.
SECTION 3: THE SCALE OF EXPOSURE
3.1 The Breach Frequency Problem
ShinyHunters has claimed more than 1,000 organizations in aggregate across its Salesforce campaigns alone as of May 2026, excluding hundreds of millions of records from the 2024 Snowflake campaigns. ⁹
Publicly named 2026 victims include Canvas, ADT, McGraw-Hill, Panera, SoundCloud, Bumble, Carnival, Pitney Bowes, Udemy, Vimeo, Rockstar, TELUS Digital, and Match Group. ⁷
This is systematic, opportunistic exploitation of SaaS trust relationships across every sector, not a targeted vertical campaign.
CrowdStrike’s 2025 reporting found 82% of detections were malware-free, with attackers relying on valid credentials and tokens. ¹¹
The average attacker breakout time from initial access to lateral movement compressed to 29 minutes in 2025. ¹¹
Detection timelines measured in days are no longer compatible with containing damage.
3.2 The Financial Cost of Getting It Wrong
IBM’s 2025 Cost of a Data Breach Report set the global average breach cost at $4.44 million, down from $4.88 million in 2024. ¹² The U.S. average reached $10.22 million in 2025, more than double the global figure. ¹²
Stolen or compromised credentials, the starting point of every ShinyHunters attack, cost an average of $4.50 million per incident per IBM 2025 data. ¹³
Third-party breaches doubled from 15% to 30% of all incidents between 2024 and 2025. ¹³ SaaS companies report API vulnerabilities as a factor in 70% of their security incidents as of 2026. ¹⁴
3.3 The Infostealer Economy Feeding the Pipeline
Infostealer subscriptions like Lumma, Redline, and Raccoon cost approximately $50 per month as of 2025-2026. ² Microsoft identified Lumma Stealer as responsible for 51% of all observed infostealer infections between October 2024 and October 2025. ¹⁵
In H1 2025 alone, infostealers compromised over 270,000 Slack credentials. ² Credentials cost less than a SaaS subscription. The economics of SaaS breach are structurally favorable to attackers.
SECTION 4: THE TECHNICAL ANATOMY OF OAUTH ABUSE
4.1 Device Code Phishing – The Attack MFA Cannot Stop
Device code phishing exploits a legitimate OAuth protocol feature to harvest Microsoft 365 access tokens without requiring the victim to enter credentials on a fraudulent site.
The attacker generates a device code, sends it to the victim, and the victim completes their own MFA challenge, authenticating the attacker’s session. The resulting refresh tokens persist even after a password reset, because the authentication was technically legitimate.
In March 2026, the Cloud Security Alliance confirmed OAuth device code phishing had been used against 340+ Microsoft 365 organizations between 2025 and early 2026. ¹⁶
Microsoft Threat Intelligence attributed a sustained device code phishing campaign in February 2025 to Storm-2372, a Russia-aligned actor targeting government, NGO, defense, and energy entities across Europe, North America, Africa, and the Middle East. ¹⁷
The technique has since been industrialized into accessible Phishing-as-a-Service platforms.
4.2 Consent Phishing and Supply Chain Compromise
Consent phishing tricks victims into authorizing malicious OAuth applications. The authorization survives password resets and MFA reenrollment because the permissions were granted by the user, not stolen from them.
Microsoft’s 2025 Digital Defense Report documented identity-based attacks rising 32% in H1 2025, with 97% still being simple password spray attempts — meaning the sophisticated token-theft subset is growing precisely because it bypasses controls already deployed. ¹⁵
Supply chain compromise remains the highest-damage vector. The April 2026 Vercel breach followed an identical structural pattern to Salesloft-Drift: an OAuth supply chain compromise via a Lumma Stealer infection at a third-party vendor exposed employee records, API keys, GitHub tokens, and NPM tokens. ¹⁸
The breach was not discovered by Vercel’s own security team. It was discovered when the attacker chose to monetize publicly.
FIGURE 3: OAuth Attack Vectors – Technical Taxonomy (2025-2026)
| Attack Vector | MFA Bypass | Real-World Example | Timeline |
| Device Code Phishing | Yes – victim authenticates attacker session | Storm-2372 targeting 340+ M365 orgs | February 2025 – March 2026 |
| Consent Phishing | Yes – permission granted, not stolen | Microsoft Entra ID campaigns | Ongoing 2025-2026 |
| Supply Chain Token Theft | Yes – tokens already authorized | Salesloft-Drift: 700+ orgs breached | March-August 2025 |
| Refresh Token Persistence | Yes – session pre-authorized | Salesloft-Drift: 5-month undetected window | March-August 2025 |
| Infostealer Session Harvesting | Yes – session already authenticated | Lumma Stealer: 51% of all infostealer detections | October 2024 – October 2025 |
(Sources: As per references shown above, Cyber Tech Intelligence Analysis)
SECTION 5: THE DEFENSE ARCHITECTURE SECURITY TEAMS NEED NOW
5.1 Visibility, Token Hygiene, and Vishing-Resistant Verification
The most consistent finding across every major SaaS breach of the past 18 months is that the compromised integration or stolen token was invisible to the security team before the breach occurred.
A university implementing Microsoft Entra ID hardening in 2025 identified and purged 1,100 unused app grants, eliminating two OAuth persistence paths that had existed for months without triggering a single alert. ¹⁹ Visibility alone, before any additional control was deployed, removed two active attack vectors.
Token management must carry the same organizational rigor as privileged account management. Enforce refresh token expiration policies aligned to data sensitivity. Implement administrative review before any third-party application receives OAuth access.
Block device code flow via Conditional Access, where it has no documented operational use — the Cloud Security Alliance’s March 2026 research recommends treating it as a legacy mechanism whose risk profile exceeds its value for most enterprises. ¹⁶
Every ShinyHunters breach documented in this report began with a social engineering step, not a technical exploit. No SSO reset or permission elevation should be complete through a single communication channel. Pre-register callback numbers for IT and help desk workflows. Require identity-proofing codes for any action that grants or modifies access. Build a verification reflex immune to urgency pressure, because urgency is the primary lever social engineers use to bypass critical thinking.
5.2 Supply Chain Vendor Assessment
The organizations that suffered most in the Salesloft-Drift, Gainsight, and Anodot campaigns made no security errors themselves. They trusted vendors who did. Third-party risk management must now include specific assessment of how vendors store OAuth tokens issued to them, what incident notification SLAs exist if a vendor is compromised, and whether vendor integration permissions follow least privilege.
IBM’s 2025 breach data places third-party involvement in 30% of all incidents, making supply chain compromise one of the highest-cost and fastest-growing breach pathways. ¹² Treating third-party OAuth grants as permanent, unreviewable trust relationships is no longer a defensible posture.
CONCLUSION: THE TRUST LAYER IS THE NEW BATTLEGROUND
The SaaS breach epidemic of 2026 was not built on sophisticated exploits. It was built on the observation that most enterprises created hundreds of trusted integrations they had never audited and could not see.
The Salesloft-Drift campaign ran for five months between March and August 2025 before detection. The April 2026 Vercel breach was discovered by the attacker, not the security team. Aura was breached in March 2026 through a single vishing call to one employee.
Microsoft’s 2025 Digital Defense Report recorded a 32% rise in identity-based attacks in H1 2025. ¹⁵
CrowdStrike documented 82% malware-free detections in 2025. IBM placed the U.S. average breach cost at $10.22 million for the full year 2025. ¹²
The attackers already understand your SaaS architecture. The question is whether your security program does too.
REFERENCES
- Valence Security (2025). Salesforce OAuth Token Breach: What Every Security Team Must Know, August 27, 2025. https://www.valencesecurity.com/resources/blogs/salesforce-oauth-token-breach-what-every-security-team-must-know
- Cyber Defense Magazine (2026). Why 2026 Will Be The Year Of SaaS Breaches, January 3, 2026. https://www.cyberdefensemagazine.com/why-2026-will-be-the-year-of-saas-breaches/
- HackRead (2026). ShinyHunters Claims Rockstar Games Snowflake Breach via Anodot, April 13, 2026. https://hackread.com/shinyhunters-rockstar-games-snowflake-breach-anodot/
- The Hacker News (2025). SaaS Breaches Start with Tokens, October 9, 2025. https://thehackernews.com/2025/10/saas-breaches-start-with-tokens-what.html
- Microsoft Security Blog (2025). Defending Against Evolving Identity Attack Techniques, May 29, 2025. https://www.microsoft.com/en-us/security/blog/2025/05/29/defending-against-evolving-identity-attack-techniques/
- Obsidian Security (2026). OAuth Vulnerabilities Every Security Team Should Know, February 6, 2026. https://www.obsidiansecurity.com/blog/oauth-vulnerabilities-security-teams
- Lumos (2026). What Is ShinyHunters? How One Cybercrime Group Is Behind a Dozen Major Cyber Breaches, May 2026. https://www.lumos.com/blog/shinyhunters-hacks
- Wikipedia (2026). Aura Data Breach, March 2026. https://en.wikipedia.org/wiki/Aura_data_breach
- Push Security (2026). How Three Techniques Are Behind ShinyHunters’ 2026 Campaigns, May 2026. https://pushsecurity.com/blog/analyzing-the-instructure-breach
- The Register (2026). Rockstar Games Gets a Taste of Grand Theft Data, April 14, 2026. https://www.theregister.com/2026/04/13/shinyhunters_rockstar_breach/
- DeepStrike (2026). Cybersecurity Statistics 2025-2026: Global Risk and Breach Metrics, May 2026. https://deepstrike.io/blog/cybersecurity-statistics-2025-threats-trends-challenges
- IBM (2025). 2025 Cost of a Data Breach Report, IBM Security, 2025. https://www.ibm.com/think/x-force/2025-cost-of-a-data-breach-navigating-ai
- StationX (2026). Cyber Security Breach Statistics 2026, April 2026. https://app.stationx.net/articles/cyber-security-breach-statistics
- SQ Magazine (2026). API Security Breach Statistics 2026, April 9, 2026. https://sqmagazine.co.uk/api-security-breach-statistics/
- Microsoft (2025). Microsoft Digital Defense Report 2025, October 2025. https://www.microsoft.com/en-us/corporate-responsibility/cybersecurity/microsoft-digital-defense-report-2025/
- Cloud Security Alliance (2026). OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations, March 25, 2026. https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-m365-20260325-c/
- Microsoft Security Blog (2025). Defending Against Evolving Identity Attack Techniques, May 29, 2025. https://www.microsoft.com/en-us/security/blog/2025/05/29/defending-against-evolving-identity-attack-techniques/
- PKWARE (2026). 2026 Data Breaches: Cybersecurity Incidents, May 2026. https://www.pkware.com/blog/2026-data-breaches
- 2toLead (2025). Microsoft Digital Defense Report 2025: What Matters Now for Microsoft 365 and Azure Leaders, October 22, 2025. https://www.2tolead.com/insights/microsoft-digital-defense-report-2025-for-microsoft-365-azure-leaders
