The Raccoon In Your CRM: ShinyHunters Took The Service Elevator

You ever watch a raccoon open a trash can like it’s cracking a safe, then stare into the porch cam like, merci, I’ll take the leftovers and your dignity too. That’s ShinyHunters with your integrations. Workiva didn’t get hit head on, their Salesforce connected gear did, through a third party, with attackers cruising the OAuth lane like it came with a toll tag and free snacks. The prize wasn’t SEC filings, it was business contact info and support ticket content. Which sounds boring until you remember social engineers don’t need wire transfers, they need three fields, a screenshot, and your trust. That beats most training before lunch, then they stay for dessert, take the silverware, and leave you the bill.

What’s actually happening, attackers are chaining the stuff companies keep treating like convenience glue instead of critical infrastructure. First, OAuth tokens from integrations like Salesloft’s Drift chat, tiny keys that open big doors, the kind you forget exist until they unlock the wrong floor. Second, support systems where people type with their inside voice, as in here’s my AWS key pasted for your convenience, or our Snowflake credentials live in this runbook, please fix our widget. Support portals are confession booths with export buttons, it sounds off until you realize the transcript gets packaged, indexed, and forwarded. ShinyHunters started the year working phones into Salesforce portals, now they scoop tokens from an upstream app, walk into downstream orgs, and scrape tickets and messages for secrets, which is a long way to say they went from casing the lobby to taking the service elevator. When a token falls off a truck and lands in a DM, that is a real token of appreciation, and yes, I will see myself out.

Names and numbers so this isn’t hand waving. Workiva sells into thousands of enterprises, a heavy slice of the Fortune 500. Cloudflare rotated 104 platform issued tokens after a Salesforce support incident in mid August, because when the house smells smoky you do not argue with the alarm. Zscaler and Palo Alto Networks found their Salesforce instances rummaged through, which is not a blip, that is a pattern. Your CRM has become a lake of exploitable context, and your integrations are little boats tied to it with fraying rope. If one vendor’s weak token policy lets an attacker impersonate your account team, reply in the right thread, quote a real case number, and drop a poisoned link, the people on the other end lose the ability to tell real from fake at human speed. Here’s the break point, you don’t need access to the core app if you already own the conversation, the badge at the front desk still says guest while the attacker sits at your conference table. That flips protection from process to luck, and luck is not a control, it is a wish. Real data beats guesswork every time, and phish happens.

And the incentives, mon dieu, they line up to make this worse. SaaS vendors monetize convenience, so integrations ship by default and the hardening work that would slow that down gets pushed to next quarter, renamed as a feature, or buried in a compliance deck while sales ships more connectors. Customers pay now in incident response hours, token rotations, and whiplash. Staff pay in sleep and trust. Later, everyone pays when the new normal becomes of course tickets contain credentials and just allowlist the whole domain, we’re busy, then we act surprised when the blast radius grows. Permissions are Velcro on a parachute, they seem fine right up until you pull and wish you had buckles, which brings us to the boring solution that actually works.

The fix is not sexy, it is necessary. Kill long lived OAuth tokens or rotate them on a schedule that makes your PM sigh. Scope tokens tight, bind them to IPs and device types where you can, shorten TTLs, and revoke everything tied to a vendor the minute they whisper security event, which, you know, like this one, is the part they swear is harmless. Treat your CRM like production with secrets, because it is, and put data loss prevention on support fields. Make most roles read only. Block file uploads unless someone proves they need it, then audit those exceptions like they owe you money. Strip secrets from tickets with automation, then shame the bots when they miss, retrain the humans when they keep pasting keys, and fix the forms that invite it, bonjour free text boxes. Sign support messages, use predictable domains, publish keys for verification, give customers a way to check you without playing guess the phish. If your vendor can’t rotate, can’t scope, can’t sign, or can’t explain their token policy in one page, treat them like a live wire.

Actual solutions look different from security theater. If it slows a rollout, forces fewer permissions, or removes a shiny connector that nobody can justify, that is probably real fixing. If it adds a new slide, a mascot, and a checkbox in the admin panel labeled advanced trust, that is probably posturing. Ask for logs you can read, revocation you can trigger, and timelines measured in hours not quarters. Ask who can impersonate your users and how you would know. Ask where support transcripts live and who can export them. If the answers arrive as a sales demo, you already have your answer.

This is supply chain security at the people layer, where the breach looks small on a status page and big in the inbox. We can stop feeding attackers better scripts if we treat integrations and support workflows as production attack surface, not office glue. Rotate, restrict, verify, and remove the secrets you can. The house is still dealing, but you don’t have to play blind. Speaking of, yes, you should care, because the raccoon is already on the porch and it knows your Wi Fi password, oh auth please. Grab coffee, then check token lifetimes and who can send mail as your support team, because the next click is either a save or a story you will hate to tell.

--Doc (yeah I said it!)

find me anywhere under @DocAtCDI