APT THREAT ALERT • SaaS Security

Salesforce Extortion: The 3 OAuth Tokens LAPSUS$ Stole From Your CRM (Check NOW)

By CyberDudeBivash • October 04, 2025 • Threat Intelligence Report

cyberdudebivash.com | cyberbivash.blogspot.com

Disclosure: This is a technical threat intelligence report for security leaders and Salesforce administrators. It contains affiliate links to relevant security solutions. Your support helps fund our independent research.

Threat Report: Table of Contents

Chapter 1: The Adversary — LAPSUS$ and Their Focus on SaaS

The LAPSUS$ extortion group burst onto the scene with a series of high-profile breaches against major technology companies. Their TTPs are a potent mix of juvenile bravado and sophisticated social engineering. They don’t typically use zero-day exploits. Instead, they master the art of compromising the human element. Their preferred tactics include SIM swapping employees, bribing insiders, and social engineering IT helpdesks to gain initial access to accounts. Once inside, they have a deep understanding of cloud environments and immediately target the most valuable assets, with a particular focus on SaaS platforms like Salesforce that house “crown jewel” customer and sales data.

Chapter 2: THE LOOT — A Deep Dive into the 3 Stolen OAuth Tokens

The attacker’s goal is not just to get a password; it’s to get a **token**. An OAuth token is a key that grants programmatic access to your data, and it’s far more valuable than a password. LAPSUS$ targets three specific types:

The Refresh Token (The Skeleton Key):** This is the ultimate prize. A refresh token is a long-lived credential that can be used to generate new, short-lived access tokens. By stealing a refresh token, an attacker can maintain persistent access to a user’s account for days, weeks, or even months, long after the user has logged out.
The Access Token (The Smash and Grab):** This is a short-lived token (often valid for an hour) that grants immediate access to the API. If an attacker can steal an active access token from a user’s browser session, they have a brief but critical window to exfiltrate as much data as possible before it expires.
**The Third-Party App Token (The Supply Chain Attack):** This is a token that you have granted to a connected application, like a marketing automation platform. If an attacker compromises that *third-party vendor*, they can use the vendor’s pre-authorized token to pivot into your Salesforce instance and steal your data. This is the exact type of risk we’ve highlighted in the **Allianz Life** and **Harrods breaches**.

Chapter 3: The Kill Chain — From Social Engineering to CRM Data Exfiltration

The typical LAPSUS$ attack against a Salesforce user is a rapid, multi-stage operation.

**Initial Compromise:** The attacker uses SIM swapping or another social engineering technique to bypass a user’s weak, phishable MFA (like SMS or push notifications) and gain initial access to their account.
**Session Hijacking & Token Theft:** The attacker, now logged in as the user, uses developer tools in their browser to find and extract the active Access Token and Refresh Token from the browser’s session storage.
**Data Exfiltration via API:** The attacker now uses these stolen tokens with scripts that make direct calls to the Salesforce API. They rapidly download all valuable objects: Accounts, Contacts, Opportunities, Leads, etc. This activity bypasses the web UI and can be difficult to distinguish from legitimate API traffic.
**Extortion:** LAPSUS$ contacts the victim organization’s executives, provides a sample of the stolen CRM data, and demands a ransom payment to prevent its public release on their Telegram channel.

Chapter 4: The Defender’s Playbook — How to Audit and Harden Your Salesforce Tenant

You must assume that your users are being targeted. A proactive, defensive posture is essential.

Step 1: MANDATE Phishing-Resistant MFA

The entire LAPSUS$ playbook is predicated on bypassing weak, phishable MFA. You can shut them down at the source by mandating the use of **phishing-resistant MFA**, specifically hardware security keys that use FIDO2/WebAuthn.

The Unphishable Defense:

A hardware key like a YubiKey cannot be phished or SIM-swapped. It is the gold standard for protecting privileged accounts and the single most effective defense against this threat actor.

Step 2: Audit and Revoke Suspicious Sessions NOW

In Salesforce Setup, go to **User Sessions**. Review this list for any active sessions from unusual locations, IP ranges, or with suspicious “Session Type” information. Select any suspicious sessions and click **”Remove”** to immediately terminate them.

Step 3: Audit and Clean Up Connected Apps

In Salesforce Setup, use the App Manager to review all **Connected Apps** that have been granted OAuth access. Scrutinize the permissions of each app. If you see an app with overly broad permissions, or any app you don’t recognize, revoke its access immediately.

Get CISO-Level Threat Intelligence

Subscribe for strategic threat analysis, APT reports, and executive security briefings. Subscribe

About the Author

CyberDudeBivash is a cybersecurity strategist with 15+ years in identity security, cloud architecture, and tracking APT and cybercrime groups, advising CISOs across APAC. [Last Updated: October 04, 2025]

#CyberDudeBivash #Salesforce #LAPSUS #OAuth #CyberSecurity #ThreatIntel #InfoSec #DataBreach #MFA #Extortion

Cyberdudebivash