Today’s Topics:

• Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity
• Microsoft’s July Patch Tuesday Follow-Up: 622 Flaws, Two Exploited Zero-Days, and a Record-Breaking Update
• How can Netizen help?

---

Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity

Threat actors linked through tactics, infrastructure, and public claims to the ShinyHunters data-extortion operation spent much of the past year gaining access to corporate Salesforce environments without exploiting a vulnerability in the platform itself.

Their access came through trust relationships that organizations had already established. Malicious OAuth applications, stolen tokens from approved software vendors, and misconfigured guest permissions allowed the attackers to query and export Salesforce data through legitimate interfaces. In many cases, the resulting traffic looked nearly identical to ordinary business activity.

Research published by Microsoft on July 13 traced campaigns from mid-2025 through mid-2026 to three main intrusion paths: voice-phishing calls that convinced employees to approve attacker-controlled connected applications, OAuth tokens stolen from compromised technology vendors, and unauthenticated access through poorly configured Salesforce Experience Cloud sites.

The campaigns affected Salesforce tenants across retail, education, manufacturing, and other industries. Their success exposed a major visibility gap in SaaS security. Authentication monitoring can identify suspicious logins, impossible travel, password spraying, and failed multifactor authentication attempts, but it may reveal little when an approved application uses a valid token through Salesforce APIs.

The more useful evidence appears after access has already been granted. Defenders need to identify which application initiated an API request, which OAuth scopes it holds, which Salesforce objects it accessed, how much data it retrieved, and whether its behavior matches the integration’s stated business purpose.

The first attack path began with a phone call.

Starting in mid-2025, attackers impersonated corporate IT support personnel and contacted employees through voice phishing. The callers guided their targets through Salesforce’s OAuth consent process and instructed them to authorize a malicious connected application presented as Salesforce Data Loader or another legitimate administrative utility.

Once the employee approved the application, the attackers gained API access under that user’s identity. They could enumerate Salesforce objects, export CRM records, maintain access through OAuth tokens, and search customer support records or internal notes for credentials connected to other cloud services.

The technique did not require malware, a Salesforce exploit, or password replay. The attacker needed a convincing pretext, a cooperative employee, and an OAuth application requesting enough access to retrieve valuable records.

Google’s Threat Intelligence Group and Mandiant documented the initial-access activity under the identifier UNC6040. Google used UNC6240 for related extortion activity. The operators frequently claimed an affiliation with ShinyHunters during communications with victims, though criminal group names in this area often overlap or are adopted by separate actors for publicity and leverage.

Google confirmed that attackers accessed one of its own corporate Salesforce environments in June 2025. The stolen information reportedly consisted mainly of basic and largely public business contact data. Google terminated the access after discovering the activity.

The same broader campaign was publicly connected to incidents involving Chanel and Pandora. Adidas, Qantas, Allianz Life, and several LVMH brands were also identified in reporting as potential or confirmed targets.

The attacks demonstrated why standard help-desk verification procedures may fail against skilled voice-phishing operators. A caller presenting as internal support can exploit an employee’s expectation that technical staff will guide them through unfamiliar configuration screens. OAuth consent prompts can also appear routine to users accustomed to connecting corporate applications.

Mandiant advised employees to end unsolicited support calls and contact the help desk through a known internal number or approved communications channel. That approach removes the caller’s control of the interaction and gives the organization a chance to verify whether the request is legitimate.

The second intrusion path bypassed employees and targeted software vendors whose applications already possessed OAuth access to customer Salesforce instances.

Compromising one vendor can give attackers access to tokens connected to hundreds of downstream organizations. API requests made with those tokens originate from an approved integration and may blend into scheduled synchronization, analytics, customer-support, or marketing activity.

Microsoft cited the August 2025 compromise of Salesloft’s Drift integration as a central example. Attackers obtained OAuth and refresh tokens associated with the Drift artificial intelligence chat platform and used them to access Salesforce environments connected to the service.

Google estimated that the incident may have exposed more than 700 organizations. Publicly identified affected companies included Cloudflare, Zscaler, Palo Alto Networks, Proofpoint, PagerDuty, and Tanium. Google tracks the activity as UNC6395, and Cloudflare’s Cloudforce One uses the identifier GRUB1.

Salesloft later reported that the intrusion began with unauthorized access to its GitHub environment as early as March 2025. The attackers used that foothold to enter Drift’s Amazon Web Services environment and obtain customer OAuth tokens.

The operators then issued Salesforce Object Query Language requests against customer environments. Their searches focused on support cases, messages, and other records that could contain Amazon Web Services keys, Snowflake tokens, passwords, and other reusable secrets. Investigators also found evidence that the attackers deleted query jobs in an apparent effort to reduce the evidence available during incident response.

A similar pattern surfaced in November 2025 through applications published by Gainsight. Salesforce disabled or restricted the applications after detecting unusual API activity. Google connected the campaign to ShinyHunters affiliates and reported activity affecting more than 200 Salesforce instances.

People claiming to represent ShinyHunters later stated that the Salesloft and Gainsight incidents collectively affected close to 1,000 organizations. That figure has not been independently verified.

The third major vendor incident identified by Microsoft involved the competitive-intelligence company Klue in June 2026. Attackers accessed the company through an old credential associated with a test integration that had never entered production but remained active.

After gaining access, the operators introduced a code change that collected OAuth tokens belonging to Klue customers. Those tokens were then used to access data stored in Salesforce and Gong environments connected to the platform. Huntress and Recorded Future were among the companies publicly identified as affected.

Microsoft tracks the Klue-related actor as Storm-3138. Other security companies connected the extortion activity to a group using the name Icarus. A Telegram account claiming to represent ShinyHunters also took credit.

The conflicting names illustrate the attribution problem surrounding financially motivated data-theft groups. Operators may work across multiple crews, reuse infrastructure, share access, sell stolen data, or adopt recognizable group names during extortion. Public claims alone rarely prove that one stable organization conducted every phase of an intrusion.

The third Salesforce attack path required no user account or OAuth token.

Microsoft observed suspicious guest-user activity targeting Salesforce Aura endpoints used by Experience Cloud sites. These portals allow organizations to expose selected Salesforce functions to customers, partners, or other external users. Guest profiles can access limited records without authentication when administrators configure those permissions.

In vulnerable environments, guest roles had been granted access to more data than the organization intended to expose. Attackers queried the Aura framework’s GraphQL controller and used cursor-based pagination to retrieve records beyond the standard 2,000-record query limit.

Microsoft associated some of this activity with AuraInspector, a tool used to examine and test Salesforce Aura endpoints. The attackers did not bypass a technical security boundary through an exploit. They accessed records that the organization’s existing permissions had already made available to unauthenticated users.

That distinction does little to reduce the impact. A configuration error can expose customer information, support records, internal objects, or other sensitive data at scale, with no compromised account available for defenders to disable.

Microsoft and Salesforce have responded by adding detection and governance capabilities focused on connected applications and Salesforce API activity.

The upgraded Salesforce connector for Microsoft Defender for Cloud Apps can ingest information from Salesforce Shield Event Monitoring and its Real-Time Event Monitoring framework. The integration is intended to provide near-real-time visibility into sessions, API requests, connected applications, and the OAuth scopes granted to each application.

Connected-app attribution gives defenders a clearer answer to a basic investigative question: which application performed the action? That distinction matters when several integrations operate through the same user account or when a compromised vendor token produces activity that resembles legitimate automation.

Microsoft also introduced governance features for identifying highly privileged OAuth applications, applications holding elevated scopes, and integrations that have remained inactive for at least 90 days without losing their permissions. Defender for Cloud Apps can assign connected applications a risk score from zero to 100 and use that score in alerts and policy decisions.

These controls are aimed at a persistent problem in SaaS environments. Organizations frequently approve applications for temporary projects, product trials, migrations, or integrations that are later abandoned. The application may stop generating visible activity, yet its OAuth grants, refresh tokens, service credentials, and API permissions remain active.

Reducing the risk requires a complete inventory of connected applications and the access assigned to each one. Applications that no longer serve a business function should be revoked. Active integrations should receive the minimum scopes required for their purpose, and administrators should review high-volume exports, unusual object access, new authorization grants, changes in API behavior, and activity from integrations that were previously dormant.

Salesforce event logs can provide much of the required evidence, but collecting logs alone is insufficient. Security teams need detections that compare an integration’s current behavior with its established baseline and business role. A marketing connector suddenly querying support cases or exporting large volumes of user records deserves investigation, even when every request uses a valid token.

Experience Cloud guest access also requires recurring review. Administrators should test guest profiles from an unauthenticated perspective, inspect object permissions, validate sharing rules, and verify that Aura and GraphQL endpoints expose only the records intended for public access.

Organizations also need a tested process for revoking and rotating OAuth tokens after a vendor compromise. Disabling a user account may have no effect on an application token issued to an integration. Incident-response procedures need to account for connected apps, refresh tokens, service accounts, API credentials, and downstream systems reached through those identities.

The three attack paths mapped by Microsoft share the same underlying weakness. Many corporate identity programs remain centered on human authentication, with controls built around passwords, multifactor authentication, conditional access, and interactive sessions. Modern Salesforce environments depend heavily on application identities and delegated access that operate outside those traditional controls.

The ShinyHunters-linked campaigns showed how attackers can exploit that gap repeatedly. One path relied on convincing a user to approve access. Another stole trust from a software supplier. The third took advantage of permissions granted to anonymous visitors.

In each case, the attackers used Salesforce in ways the platform was configured to permit. The failure occurred in how organizations granted, monitored, and retired access around it. The most damaging credential was sometimes not a stolen password, but an OAuth token, an approved application, or a forgotten integration that nobody had switched off.

---

Microsoft’s July Patch Tuesday Follow-Up: 622 Flaws, Two Exploited Zero-Days, and a Record-Breaking Update

Microsoft’s July 2026 Patch Tuesday release was already notable for its size, but a closer review of the update reveals a more urgent story behind the record numbers. The company addressed 622 unique vulnerabilities across its products, making this the largest Patch Tuesday release Microsoft has issued to date, and two of the patched flaws were already being exploited in active attacks.

The new total is more than three times the roughly 200 Microsoft vulnerabilities addressed in June. Windows accounts for most of the volume, but the two vulnerabilities that deserve immediate attention affect systems that sit at the center of enterprise identity and collaboration: on-premises SharePoint Server and Active Directory Federation Services.

Both flaws are elevation-of-privilege vulnerabilities rather than high-profile unauthenticated remote code execution bugs. Their technical classifications may appear less severe than some of the Critical vulnerabilities included in the release, yet their placement inside document-management and identity infrastructure makes them especially dangerous.

CVE-2026-56164 affects Microsoft SharePoint Server and is being exploited in active attacks. Microsoft says an unauthenticated attacker can use the flaw over a network to elevate privileges without requiring credentials or user interaction.

Microsoft credited Mandiant incident responders and Google’s FLARE team with reporting the vulnerability, suggesting that it was identified during an investigation into real-world malicious activity. Microsoft has not publicly described the exploitation chain, the threat actor involved, or the privileges an attacker can obtain after successful exploitation.

Organizations operating self-hosted SharePoint should treat CVE-2026-56164 as the top remediation priority from this month’s release. Its urgency is increased by the fact that SharePoint Server 2016 and SharePoint Server 2019 reached the end of extended support on July 14, 2026.

Unlike some other Microsoft server products, those SharePoint versions do not have a paid Extended Security Updates program available as a temporary fallback. Organizations that remain on either version face a choice between migrating, upgrading, or operating infrastructure that will no longer receive routine security fixes.

Microsoft also states that enabling the Antimalware Scan Interface in Full Mode can reduce exposure to the SharePoint attack. That setting should be viewed as a compensating control rather than a replacement for patching.

SharePoint has remained a frequent target for attackers after the ToolShell exploitation activity seen in 2025. Internet-facing deployments provide access to corporate documents, internal data, credentials, service accounts, and application integrations, giving attackers several possible routes for lateral movement after the initial compromise.

The second actively exploited vulnerability, CVE-2026-56155, affects Active Directory Federation Services. Microsoft says an authenticated attacker can exploit weak access controls locally to elevate privileges.

Microsoft’s Detection and Response Team received credit for discovering the flaw, which also suggests it was identified through incident-response activity. Microsoft has not disclosed what level of privilege attackers can gain or how the flaw was used in the observed intrusions.

The word “local” may make the vulnerability sound less urgent than a remote exploit, but AD FS servers occupy a sensitive position inside enterprise authentication architecture. AD FS creates and signs tokens that other systems trust. An attacker who has already gained limited access to the host may be able to use a privilege-escalation flaw to expand control over the identity infrastructure and potentially interfere with token issuance or federation services.

Neither CVE-2026-56164 nor CVE-2026-56155 had been added to the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog at the time of the original reporting. Microsoft’s Security Update Guide already marks both as exploited, so organizations should not delay remediation while waiting for CISA to add them to the catalog.

The SharePoint flaw also demonstrates why CVSS ratings should not be used as the sole patching priority. A vulnerability’s practical risk depends on active exploitation, network exposure, system function, available mitigations, and the value of the data or privileges attackers can reach.

Microsoft addressed a third zero-day in the July release, but it was publicly disclosed rather than observed in active attacks. CVE-2026-50661 is a BitLocker security-feature bypass that requires physical access to the device.

The flaw should still be patched, particularly on portable systems that may be lost, stolen, or handled by unauthorized users. It does not carry the same immediate network-based risk as the exploited SharePoint vulnerability.

The BitLocker issue continues a series of bypass discoveries reported during 2026, including techniques referred to as bitskrieg and YellowKey. These flaws reinforce the need to treat full-disk encryption as one part of device protection rather than a complete defense against every physical-access scenario.

SharePoint received another significant update this month through CVE-2026-55040, a JSON Web Token authentication bypass disclosed by Rapid7 Labs after research conducted for Pwn2Own Berlin.

There is disagreement over the vulnerability’s severity rating. Rapid7 described the issue as medium severity with a CVSS score of 5.3, while Trend Micro’s Zero Day Initiative interpreted the release as assigning it a Critical rating of 9.1.

The technical impact is more important than the scoring dispute. Rapid7 chained the authentication bypass with a separate remote code execution vulnerability to achieve unauthenticated code execution against a vulnerable SharePoint server.

Microsoft patched the authentication-bypass component in July, but the remote code execution vulnerability used in the chain is expected to receive a fix in August. Installing the July update still breaks the demonstrated exploit chain and reduces the chance that attackers can combine the two issues successfully.

The four-point difference between published severity interpretations also illustrates the limitations of score-based remediation. A vulnerability with a moderate standalone impact can become far more dangerous once researchers or attackers combine it with a separate flaw.

Microsoft’s July updates also complete another stage of the company’s long-running effort to reduce the use of RC4 encryption in Kerberos authentication.

The update removes the RC4DefaultDisablementPhase rollback switch, which administrators could previously use to reverse or delay parts of the RC4 hardening process. After the July update, RC4 remains available only for accounts explicitly configured to permit it.

This change can cause authentication failures for legacy services or service accounts that still request RC4 tickets. Organizations should review the RC4 audit events Microsoft introduced in January before deploying the update broadly.

Service accounts that lack AES keys may need password rotation so that Windows can generate new encryption keys. Password rotation will not correct accounts or applications that are intentionally configured to require RC4, nor will it fix legacy clients that do not support newer Kerberos encryption types.

Those systems require configuration changes, software upgrades, or replacement before administrators remove RC4 support. Skipping the audit may turn an otherwise successful security deployment into an authentication outage affecting business-critical services.

Windows accounts for 416 of the 622 unique CVEs in the July release. Among them is CVE-2026-57092, a Virtual Machine Switch remote code execution vulnerability rated 9.9, the highest published score in the release.

The Windows updates also include five DHCP remote code execution vulnerabilities and 21 flaws affecting NTFS and ReFS drivers. Zero Day Initiative researchers assessed the storage-driver vulnerabilities as likely sharing a common underlying cause.

Microsoft Office accounts for 82 unique vulnerabilities. Some reports list 164 because Microsoft repeats the same 82 vulnerabilities under a separate Office 2016 product track. Counting each CVE once produces the lower figure.

Microsoft Edge received 46 listed fixes, though Zero Day Initiative counted 21 as Microsoft-specific vulnerabilities rather than Chromium issues that were being reissued through Microsoft’s update process.

Developer products received 27 fixes across Visual Studio, Visual Studio Code, and GitHub Copilot. Many of those vulnerabilities involve injection issues, path traversal, or security-feature bypasses.

SharePoint Server received 17 fixes. Those include the actively exploited CVE-2026-56164, the JWT bypass tracked as CVE-2026-55040, and two Critical remote code execution vulnerabilities, one of which is CVE-2026-50522 with a score of 9.8.

Azure received 11 fixes, though none were identified in the original analysis as requiring emergency action. SQL Server received eight updates, including CVE-2026-54117 and CVE-2026-54118, two remote code execution vulnerabilities rated 8.8.

Microsoft Defender received five fixes, including two Critical remote code execution vulnerabilities. Exchange Server also received five fixes.

One of the Exchange vulnerabilities, CVE-2026-55008, is a stored cross-site scripting flaw in Outlook Web Access rated 9.6. Microsoft categorized it as a spoofing vulnerability, though its stored nature and placement inside webmail infrastructure may create a greater practical impact than that label suggests.

The final count differs slightly depending on the source and counting method. Microsoft’s Security Update Guide lists 622 unique CVEs, while Zero Day Initiative counted 621 independently.

Microsoft warned customers five days before Patch Tuesday that future security releases could contain higher volumes of updates. The company attributed part of the increase to the use of artificial intelligence in vulnerability discovery.

Microsoft has previously described MDASH, a multi-model agent-based scanning system that found 16 vulnerabilities included in the May 2026 Patch Tuesday release. The company has not disclosed how many of July’s 622 vulnerabilities were discovered through that system or other automated research tools.

Automated vulnerability discovery may help vendors identify security defects earlier, but it also increases the volume of updates that defenders must assess, test, and deploy. A release containing more than 600 CVEs can overwhelm remediation programs that rely on manual triage or basic severity filters.

Patch publication can also give attackers a roadmap. Once Microsoft releases updated binaries, threat researchers and malicious operators can compare them with older versions, identify the changed code, and reconstruct the vulnerability.

That process can reduce the time between patch publication and working exploit development. Organizations that historically delayed deployment for several weeks may find that attackers can produce reliable exploit code before internal testing cycles are complete.

The July release also shows why a Critical or High label is no longer enough to establish a useful remediation order. With hundreds of vulnerabilities in a single update, defenders need threat-based prioritization rather than a queue sorted only by CVSS.

The two flaws being exploited in active attacks are not the highest-scoring vulnerabilities of the month. They are privilege-escalation issues affecting systems attackers value: a corporate document platform and an identity federation server.

Organizations should begin with Microsoft’s exploited status, CISA’s Known Exploited Vulnerabilities catalog when applicable, public evidence of exploitation, system exposure, and whether a vulnerable host controls authentication, sensitive records, or privileged access.

Exploit Prediction Scoring System data can provide another signal, but no single score should replace direct analysis of the affected asset and its function inside the environment.

The main lesson from this month’s Patch Tuesday is no longer just that Microsoft fixed a record number of vulnerabilities. The larger concern is that patching programs built around monthly volume and CVSS thresholds are becoming less useful as Microsoft identifies more flaws and attackers convert updates into exploit intelligence faster.

The two actively exploited zero-days should be patched first, followed by the SharePoint authentication bypass that breaks a pending exploit chain. Organizations should also assess their RC4 dependencies before deployment to prevent avoidable Kerberos failures.

The total may be 622, but defenders do not need to treat all 622 issues as equal. The practical task is to identify which flaws are already being used, which systems provide the most valuable access, and which updates can disrupt production if deployed without preparation.

---

How Can Netizen Help?

Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally. 

Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.

Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.

Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.

---