Safeguarding Against ShinyHunters
Customer Town Hall | Wednesday, September 23 at 9:00 a.m. PDT
ShinyHunters has spent the past year turning OAuth approvals into a way in. Someone gets a call, approves what looks like a routine app connection, and the stolen token gives the attacker persistent access to Salesforce and every connected app downstream. It's how they got into environments through Drift and Gainsight, and it's still active. McKesson, Kimberly-Clark, and Neogen are this month's confirmed targets.
In this live webinar, our executive team and threat research leaders will walk you through the mechanics of this campaign and what to check in your own environment before it reaches you.
How the OAuth path works:
The exact sequence from vishing call to approved app to persistent Salesforce token, and why it bypasses MFA
What to check in your environment this week:
The specific OAuth grants, connected apps, and service accounts most likely to be affected
Live Q&A with our threat research team:
Direct access to the people tracking this campaign
Personalized threat report (to follow the webinar):
Which of your OAuth grants and service accounts you need to review first, in order, with mitigation steps you can put in place immediately
Speakers:
Ofer Klein, Co-Founder and CEO
Tal Shapira, Co-Founder and CTO
Gal Nakash, Co-Founder and CPO
Zoe Hillenmeyer, COO
Ophir Kelman, Head of Security Research
ShinyHunters has spent the past year turning OAuth approvals into a way in. Someone gets a call, approves what looks like a routine app connection, and the stolen token gives the attacker persistent access to Salesforce and every connected app downstream. It's how they got into environments through Drift and Gainsight, and it's still active. McKesson, Kimberly-Clark, and Neogen are this month's confirmed targets.
In this live webinar, our executive team and threat research leaders will walk you through the mechanics of this campaign and what to check in your own environment before it reaches you.
How the OAuth path works:
The exact sequence from vishing call to approved app to persistent Salesforce token, and why it bypasses MFA
What to check in your environment this week:
The specific OAuth grants, connected apps, and service accounts most likely to be affected
Live Q&A with our threat research team:
Direct access to the people tracking this campaign
Personalized threat report (to follow the webinar):
Which of your OAuth grants and service accounts you need to review first, in order, with mitigation steps you can put in place immediately
Speakers:
Ofer Klein, Co-Founder and CEO
Tal Shapira, Co-Founder and CTO
Gal Nakash, Co-Founder and CPO
Zoe Hillenmeyer, COO
Ophir Kelman, Head of Security Research
We’ve seen a recent uptick in ShinyHunter attacks against our customers. In this session, we’ll discuss what’s happening, why the attacks were successful, and what you can do to protect your environment.