Nobody Is Hacking Salesforce

That sentence is not a defense of the vendor. It's the single most important analytical fact about the last 18 months of CRM compromise, and it is the reason most organizations remain exposed.

Across every major Salesforce-linked breach of 2025 and 2026 — Salesloft Drift, Gainsight, the Experience Cloud guest user campaign, Klue — there is no exploited platform vulnerability. No CVE in the core platform. No zero-day. Attackers have been walking through doors that customers opened themselves: over-permissioned guest profiles, OAuth tokens held by third-party vendors, employees talked into authorizing a malicious connected app, and now AI agents that read attacker-supplied text and do what it says.

The threat landscape here isn't a software problem. It's a trust-boundary problem, and 2026 has been the year attackers industrialized it.

Attack Path One: The Guest User Campaign

The defining Salesforce campaign of 2026 started quietly in September 2025 and didn't become public until March.

Salesforce Experience Cloud lets organizations spin up customer-facing portals wired directly into their CRM. Anonymous visitors to those portals share a guest user profile — intended for landing pages, FAQs, and knowledge articles. When that profile is configured with excessive permissions, particularly the API Enabled system permission, an unauthenticated visitor can query CRM objects directly through the /s/sfsites/aura endpoint. No credentials. No login event. No failed-authentication signal for your SOC to catch.

The escalation came from an unexpected direction. In January 2026, Mandiant released AuraInspector, an open-source tool built to help administrators audit exactly these misconfigurations. Within weeks, the threat actor modified it. While the original tool identifies vulnerable objects by probing API endpoints, the weaponized variant extracts data at scale, and reporting indicates it pivoted to Salesforce's GraphQL interface to bypass the roughly 2,000-record ceiling of older extraction techniques.

Then they mass-scanned the internet for the Aura endpoint.

Salesforce published guidance on March 7, 2026, and posted a trust-site notice on March 12. The actor, posting as ShinyHunters, initially claimed roughly 100 high-profile companies; subsequent reporting put the figure closer to 300–400. The 2026 victim timeline that followed reads like a sector-agnostic sweep:

A caveat that matters for anyone building a dataset from this: every record count above is an attacker claim posted to a leak site or Telegram channel, not a verified figure. McGraw-Hill publicly disputed the characterization of its incident, stating that core Salesforce accounts and customer databases were not compromised. Treat claimed volumes as an upper bound reflecting extortion leverage, not forensics.

Note also what the stolen data gets used for. FINRA's member alert on this campaign flagged that the exfiltrated CRM records feed directly into follow-on targeted phishing, vishing, and extortion against firm personnel and clients. A guest-user exposure isn't just a disclosure event — it's ammunition for the next intrusion.

The fix is embarrassingly simple

Salesforce's remediation guidance is short enough to action this afternoon:

• Uncheck API Enabled in the guest user profile's System Permissions. This is the single highest-impact change; it closes the exact vector.
• Set org-wide defaults to Private for external users.
• Disable Portal User Visibility and Site User Visibility in Sharing Settings, so guests can't enumerate internal org members.
• Disable self-registration if your site doesn't need it. Guest-tier data exposure has been chained into self-registered portal accounts, escalating unauthenticated access into an authenticated session.
• Review Aura event monitoring logs for unusual query volume, unfamiliar source IPs, or access to objects that were never meant to be public.
• Designate a Security Contact in your org so Salesforce can reach the right person.

One known limitation worth flagging: public group membership may remain visible via the same Aura endpoints and cannot currently be restricted at the guest-user level.

Attack Path Two: OAuth and the Fourth Party

The second path is more structurally dangerous, because remediating your own org does nothing to close it.

The pattern established with Salesloft Drift in August 2025 — where UNC6395 stole OAuth tokens and pulled data from more than 700 Salesforce environments in about a week — repeated with Gainsight in November 2025 (200+ companies), and again in June 2026 with Klue, a competitive intelligence platform.

The Klue anatomy is worth studying because it is so mundane:

1. June 11 — Attackers authenticate to Klue's integration backend using a legacy service-account credential left over from a test integration that was never deployed and never rotated. No exploit. A valid, organization-issued credential. No login anomaly.
2. They push a code update that harvests customer OAuth tokens — the ones connecting Klue to Salesforce, Gong, HubSpot, Slack, and others. It looks like a routine deployment. No malware signature.
3. June 12 — Klue detects anomalous behavior and unusual outbound connections.
4. June 13 — Klue revokes OAuth credentials and disables integrations; Salesforce disables the Klue integration.
5. June 16 — Extortion emails begin arriving at targeted companies.

Reporting places the blast radius near 200 organizations, including LastPass, Huntress, Recorded Future, Tanium, and Jamf. Automated scripts reportedly made roughly 1,000 calls to the Salesforce REST API every 15 minutes for a continuous 24-hour period.

Two details deserve emphasis.

Tanium appears on both the Drift and Klue victim lists, ten months apart. Same trust model, different vendor. That is what a structural exposure looks like — you can be fully compliant, fully patched, and get hit twice through two entirely separate fourth parties.

Regulators are now treating fourth-party OAuth incidents as in scope. FINRA issued a member alert referencing the Klue breach, even though Klue is nowhere near financial services. A breach two hops removed from a regulated firm was enough to trigger formal notice — a preview of where SaaS supply chain regulation is heading.

Attack Path Three: The Human OAuth Flow

The 2025 vishing campaign deserves a mention because its residue is still in your org.

The technique was elegant: attackers impersonated IT support by phone, walked employees to Salesforce's connected app setup page, and had them enter an eight-digit code. That triggered an OAuth 2.0 authorization flow for a malicious connected app — often a rebranded Data Loader variant — granting persistent API access with the authorizing user's permissions. It bypassed MFA entirely, because it never touched the login event. It targeted the post-authentication action.

Victims included Google, Allianz Life, Adidas, Qantas, and multiple LVMH brands.

Salesforce has since blocked user self-authorization for uninstalled connected apps in most profiles and killed the OAuth Device Flow outright. But existing authorizations were grandfathered. If a user connected an uninstalled app before enforcement, that grant may still be live. Audit your Connected Apps OAuth Usage page against a list of apps you actually intended to have.

Attack Path Four: The Agent Reads the Attacker's Mail

This is the emerging surface, and it will define 2027.

ForcedLeak (Noma, September 2025) demonstrated CRM data exfiltration from Agentforce via indirect prompt injection through Web-to-Lead forms, chained with a permissive Content Security Policy. PipeLeak (Capsule Security, April 2026) showed the same class of attack surviving into 2026: an attacker embeds instructions in a public-facing lead form; an internal user later asks the agent to review that lead; the agent executes the embedded instructions, retrieves CRM data via its lead-lookup function, and emails it out. Researchers demonstrated bulk extraction — where a single form submission becomes a database export pipeline.

The root cause is architectural, not a bug: untrusted form input is concatenated directly into the agent's context window, while that same agent simultaneously holds read access to CRM data and authority to send outbound email. Read plus send, with no trust boundary between them, is an exfiltration primitive.

Salesforce remediated the specific reported scenario and notes that Human-in-the-Loop confirmation is enabled by default for email-based agentic actions. Capsule maintains the email channel remains exploitable on Sub-Agents (formerly Custom Topics), which represent the bulk of enterprise deployments. Notably, the parallel Microsoft Copilot Studio flaw received a CVE (CVE-2026-21520, CVSS 7.5); PipeLeak did not — Salesforce characterized the exfiltration component as configuration-specific.

That disagreement is the whole story of this landscape in miniature. Vendor says configuration. Customer hears "not my problem." Data leaves anyway.

If you are deploying Agentforce: inventory, which agents can both read sensitive objects and take an external action? Enforce human-in-the-loop on every outbound channel, including sub-agents. Cap the volume of records any single agent invocation can return. Treat every free-text field a stranger can populate — lead forms, case descriptions, chat transcripts — as untrusted input reaching an execution context.

A Note on Attribution

If you are building structured intelligence from this campaign, resist the urge to normalize everything to "ShinyHunters."

The evidence suggests ShinyHunters functions less as a fixed group than as a brand applied at the moment of extortion. The Klue intrusion is attributed operationally to a cluster calling itself Icarus, which Microsoft tracks as Storm-3138; a Telegram account claiming to be ShinyHunters took credit at the extortion stage. ReliaQuest could not independently verify that account's authenticity and noted an unrelated actor may simply be borrowing the reputation for leverage.

The broader campaign spans clusters tracked as UNC6040, UNC6240, UNC6395, and Storm-3138, with overlapping tradecraft borrowed from Scattered Spider (UNC3944) and the wider Com ecosystem. Access-as-a-service on one side, extortion-as-a-service on the other, loosely coupled.

Practical implication: attribute to observed behavior and named clusters, flag brand claims as claims, and never collapse an operator attribution into an extortion-stage brand claim. If your schema has a single threat_actor field, you will lose this distinction — consider separate columns for operating cluster and claiming entity.

Salesforce's Response: The 2026 Enforcement Wave

Between January and July 2026, Salesforce converted roughly eight security controls from recommendation to hard enforcement across every paid org:

• Jan 20 — Device activation required for external SSO logins
• April — Email domain verification (unverified domains are silently dropped — no bounce, no error)
• Apr 24 — Blocking of VPN, proxy, and high-risk IP connections
• Jul 1 — Phishing-resistant MFA required for System Administrators and anyone holding Modify All Data, View All Data, Customize Application, or Author Apex; step-up authentication on report actions
• Jul 13 — Step-up auth on anomalous report exports; auto-created default Transaction Security Policy on exports over 10,000 records
• Jul 20 — Standard MFA for all employee users

Phishing-resistant means built-in authenticators (Touch ID, Face ID, Windows Hello) or WebAuthn/U2F hardware keys. TOTP authenticator apps no longer satisfy the requirement for privileged users. All of these deadlines have now passed.

The rollout drew real criticism from the partner community — compressed timelines, requirements that shifted mid-flight, and admins locked out of long-standing developer orgs. Fair complaints. But look at what each control targets: device activation and phishing-resistant MFA close the vishing path; export step-up and the default TSP close bulk exfiltration; domain verification closes phishing infrastructure. This is a vendor moving controls from the customer's side of the shared responsibility line to its own, because the customer side kept failing.

What Actually Matters Going Into 2027

Three things.

One: your attack surface is a list of vendors, not a list of servers. Every OAuth grant is a persistent, MFA-immune credential sitting in someone else's infrastructure, subject to their credential rotation hygiene — which, as Klue demonstrated, may amount to a test credential from a project that never shipped. Inventory your connected apps. Scope them down. Set expirations. Build and test an OAuth incident-response playbook: rapid token revocation, impact assessment, and forensic scoping. When the next vendor gets popped, the difference between a bad week and a disclosure event is how fast you can revoke.

Two: detection has to move to the API layer. None of these campaigns generates a failed login. Guest user extraction generates no login at all. OAuth abuse looks like a legitimate integration doing legitimate work. Your signal is volumetric and behavioral — query rates, unfamiliar source IPs, access to objects outside a normal pattern, and exports at odd hours. Event Monitoring is not optional at this point.

Three: the agentic surface is the guest user problem again, one abstraction layer up. In both cases, the failure is the same: a system granted more capability than its threat model assumed, processing input from strangers. We spent 2026 learning that lesson about guest profiles. We are about to learn about agents again, and the blast radius will be larger because agents don't just read data — they act.

The pattern holds. Salesforce isn't being hacked. The trust around it is.

Why Organizations Choose Zaxtron

Organizations face increasingly sophisticated ransomware campaigns that exploit unpatched systems, stolen credentials, exposed remote access, and third-party weaknesses. To stay protected, they need actionable intelligence, not just alerts, to identify and reduce cyber risks before disruption occurs. Zaxtron provides Cybersecurity Risk Management, AI Risk Management, and Cyber Threat Intelligence services that deliver continuous visibility and risk-based insights. By combining attack surface intelligence, vulnerability data, threat and breach intelligence, and third-party risk analysis, Zaxtron offers a complete view of cyber exposure. This helps security leaders respond to threats, improve vendor security, and make informed decisions. Contact Zaxtron to strengthen cyber resilience today.

Sources

• Salesforce: Protecting Your Data — Experience Cloud Guest User Access
• FINRA: Cybersecurity Alert — Salesforce Experience Cloud Security Incident
• The Hacker News: Threat Actors Mass-Scan Salesforce Experience Cloud via Modified AuraInspector
• The Hacker News: Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity
• Salesforce Ben: Salesforce Hacks 2026 — Everything We Know So Far
• ReliaQuest: Klue Integration Abused in Salesforce Data Theft
• BleepingComputer: Klue OAuth Breach Linked to Icarus Salesforce Data Theft Attacks
• Vectra AI: ShinyHunters Isn't a Group, It's a Pattern
• Dark Reading: Microsoft, Salesforce Patch AI Agent Data Leak Flaws
• CSO Online: Copilot and Agentforce Fall to Form-Based Prompt Injection Tricks
• Obsidian Security: Salesforce GraphQL Guest User Exploit
• Coalition: Security Alert — Critical Data Exposure in Salesforce Experience Cloud
• Salesforce Ben: Salesforce Security Roadmap 2026