Salesforce is investigating a new supply chain incident in which attackers abused OAuth tokens associated with Gainsight-published applications to access customer Salesforce environments. In an advisory, Salesforce said it detected unusual activity involving Gainsight apps connected to customer orgs and responded by revoking all active access and refresh tokens for those applications and temporarily removing them from the AppExchange while the investigation continues. The company stressed that there is no evidence of a vulnerability in the core Salesforce platform itself; the activity appears to be limited to the way third-party applications were connected to customer instances.
Gainsight, which provides customer success and product analytics tools, confirmed the disruption on its status pages and said that Salesforce’s revocation of tokens affected its Salesforce Connector and related integrations. The company has engaged Mandiant, part of Google Cloud, to conduct a forensic investigation and is working with Salesforce to notify potentially affected organizations. In a statement, Gainsight said its current findings indicate the activity originated from the external application connection rather than from a flaw in Salesforce or Gainsight’s core platforms.
Researchers at Google’s Threat Intelligence Group have linked the activity to actors associated with ShinyHunters, the group that previously targeted Salesloft and Drift integrations in an earlier campaign against Salesforce ecosystems. In that earlier wave, attackers compromised OAuth tokens for third-party SaaS integrations and used them to access data in Salesforce orgs without triggering conventional login alerts. The new Gainsight-related activity appears to follow the same pattern, with attackers focusing on the trusted connector and its tokens rather than directly attacking Salesforce accounts. Reporting from The Hacker News and Reuters indicates that ShinyHunters has claimed the combined Salesloft and Gainsight campaigns enabled data theft from hundreds, possibly close to a thousand organizations, although those figures have not yet been independently verified.
The incident underlines how OAuth tokens have become a target in their own right. Once a connector is granted access to a Salesforce org, its tokens often carry broad API permissions and may be renewed automatically for long periods. If an attacker can obtain those tokens, they can pull data, modify records, or create new integrations in ways that look like normal application traffic. Because these interactions often bypass interactive logins, they can slip past controls that focus on user sign-in anomalies rather than downstream API behavior.
For CISOs and security teams, immediate steps include confirming whether Gainsight apps were in use, reviewing Salesforce’s advisory and any direct notifications, and checking logs for unusual API activity tied to Gainsight integrations. Revoking unused connected apps, tightening scopes for remaining integrations, and enforcing centralized registration and review for all marketplace apps connected to Salesforce can help reduce exposure. Longer term, organizations may want to treat SaaS-to-SaaS OAuth connections as privileged identities, with the same lifecycle management, monitoring, and periodic recertification they apply to human and machine accounts.
Sources: Help Net Security, Cybersecurity Dive, The Hacker News, Reuters
—
By Ali Nassar-Smith
