Microsoft: ShinyHunters Abuse Salesforce OAuth for Data Theft
Microsoft says ShinyHunters-linked actors abused Salesforce OAuth apps, vendor integrations, and guest access to steal CRM data without exploiting a Salesforce platform flaw.
Author profile
Emma Davis
Content editor and security writer focused on making malware-removal and scam-prevention guides easier to understand. Emma reviews structure, clarity, and source consistency before articles are published.
1,115 articles
Editorial review
Reader clarity
Security guidance
Published work
Recent articles by Emma Davis
News · July 13, 2026
Cisco IOS CVE-2008-4128 Hits CISA KEV After Active Exploitation
CISA added Cisco IOS CVE-2008-4128 to KEV after active exploitation. Check Cisco 871 IOS 12.4 routers, restrict management access, and replace unsupported devices.
News · July 13, 2026
Evilginx Microsoft 365 Phishing Exposes Device Code Risk
Lexfo exposed three Evilginx Microsoft 365 phishing operations, including device code flow abuse that can leave valid tokens even when users pass MFA.
News · July 12, 2026
RedHook Android RAT Uses Wireless ADB for Shell Access
RedHook Android malware now abuses Wireless ADB and Shizuku-style privilege flows to gain shell-level access on infected phones without rooting the device.
News · July 12, 2026
ACSC CMS Webshell Alert: Patch WordPress and Joomla Plugins Now
Australia's ACSC warns that attackers are exploiting known CMS and plugin flaws to plant webshells on WordPress, Joomla, Craft CMS, MetInfo, and other websites.
News · July 11, 2026
jscrambler npm Attack: Compromised Releases Dropped Infostealer
Developers who installed jscrambler 8.14.0, 8.16.0, 8.17.0, 8.18.0, or 8.20.0 should audit build systems, upgrade to 8.22.0, and rotate exposed secrets.
News · July 11, 2026
Zimbra 10.1.19 Patches Critical Classic Web Client XSS
Zimbra 10.1.19 fixes a critical Classic Web Client stored XSS flaw where crafted emails can run malicious script in a user webmail session.
News · July 10, 2026
CISA Adds Two KEV Bugs: Patch Balbooa and iCagenda CVEs
CISA added Balbooa Forms CVE-2026-56291 and iCagenda CVE-2026-48939 to KEV after active exploitation. Joomla admins should patch, then check upload folders and accounts.
News · July 10, 2026
Injective SDK npm Attack: 1.20.21 Stole Wallet Keys
Developers who installed @injectivelabs/sdk-ts 1.20.21 should treat wallet private keys and mnemonics as compromised and upgrade to the clean 1.20.23 release.
News · July 9, 2026
GigaWiper Malware: Microsoft Warns of Destructive Windows Backdoor
Microsoft has detailed GigaWiper, a Windows backdoor that can spy on systems and destroy them through disk wiping, fake ransomware, and boot-drive sabotage.
News · July 9, 2026
Ubiquiti CVE-2026-50746: Patch Critical UniFi Flaws
Ubiquiti patched seven critical UniFi vulnerabilities, including CVE-2026-50746, a CVSS 10.0 command-injection issue in UniFi Connect. Update exposed controllers and appliances now.
News · July 8, 2026
Langflow CVE-2026-55255 Hits CISA KEV: Patch AI Workflows
CISA added Langflow CVE-2026-55255 to KEV after active exploitation. Patch self-hosted AI workflow servers to 1.9.1 and check for credential-theft signs.
