Precursor Intelligence

Threat News

Latest cyber threat intelligence, breaches and exploitation

1 matching story

Cato Networks
  • Threat Actor Activity5 Sept 2026·12 sources

    ShinyHunters Bypasses MFA With Salesforce OAuth Playbook

    Cato Networks publishes a 2026 threat-actor profile for ShinyHunters, detailing its MFA-bypass playbook (help-desk vishing + malicious Salesforce connected app + OAuth token) and the UNC6040 campaign that targets Salesforce, Salesloft Drift, and Gainsight integrations.

    ShinyHuntersSalesforceMFA bypass+3
    ShinyHunters Bypasses MFA With Salesforce OAuth Playbook