An employee gets a call from "IT support". Ten minutes later, 1.2 million Salesforce records can be downloaded to an external server. This scenario has been observed in real incidents reported by Google, Reuters, and McAfee in 2025.
1. What Changed
Groups like UNC6040, Scattered Spider, and ShinyHunters moved from zero day exploits to social engineering plus OAuth. Salesforce has no code vulnerability. The problem is the token the user willingly hands over.2. How the Attack Happens in Practice
The flow observed in recent campaigns follows this pattern:- OSINT: Attackers map targets on LinkedIn. Common roles: Financial Analyst, SDR, Support. Typical access: Salesforce.
- Vishing: Direct call impersonating IT. Common script: "We detected suspicious activity. I need you to authorize Data Loader so I can validate."
- OAuth Abuse: Victim goes to Setup > Connected Apps and approves a fake "Data Loader". The app receives a refresh_token with api and full scope.
- Exfiltration: Use of Bulk API. First query with LIMIT 100 to validate. Then SELECT FIELDS(ALL) FROM Account, Contact, Case. Reported volume: 50k records per minute.
- Persistence: The token does not expire. Even after a password reset, access remains.
3. Impact for Companies
- Financial: GDPR fines up to 4 percent of revenue. Free Mobile case: 42 million euros.
- Operational: Compromised token allows silent export. No login alert, no traditional MFA block.
- Reputational: Google, Adidas, Qantas, and Toyota had data exposed through this vector in 2025.
4. How to Defend
- Connected Apps Lockdown: Setup > Connected Apps > Block. Allow only apps with verified Publisher.
- Phishing resistant MFA: FIDO2, YubiKey, Windows Hello. SMS and TOTP are bypassed via real time proxy.
- EventLogFile Monitoring: Alert on EventType = BulkApi with ROWS_PROCESSED greater than 10000 from external IP.
- Active Revocation: Setup > Users > OAuth Connected Apps > Revoke. Run biweekly.
- Threat Detection: Enable API Anomaly and Credential Stuffing in Salesforce Shield.
5. Technical View
In environments without Connected App control, time to get the first data dump can be under 15 minutes. Average detection time reported in public incidents exceeds 15 days. In that window, the attacker maps customers, pricing, and roadmap. The difference between risk and control is validating the surface before a real attack.6. Conclusion
OAuth is not a future problem. It is the vector exploited today against Salesforce, M365, and GitHub. If your team is not auditing Connected Apps or monitoring Bulk API, there is active exposure.Antisec specializes in Red Team, Pentest, and AppSec focused on human and identity surface. We validate vishing, OAuth abuse, and lateral movement risk in a controlled environment, with technical evidence and a remediation plan. Talk to a specialist and request an exposure assessment for your Salesforce tenant.
