SHINNYHUNTERS BEHIND SALESFORCE DATA THEFT ATTACKS AT QANTAS, ALLIANZ LIFE, AND LVMH

Summary from the TLDR InfoSec newsletter

Google's Threat Intelligence Group has identified a wave of data breaches as being linked to the ShinyHunters group, debunking the belief that it was associated with ScatteredSpider. In these attacks, the attackers impersonated IT support staff in targeted vishing calls to persuade employees into visiting Salesforce's connected app setup page and then entering a “connection code” that linked a malicious version of Salesforce's Data Loader OAuth app.