Defending SaaS-based applications against ShinyHunters OAuth abuse

Microsoft Threat Intelligence observed activity attributed to ShinyHunters that abuses OAuth and SaaS app trust to gain access to organizations. The actor’s tradecraft includes voice phishing (vishing) to trick users into granting OAuth app consent, supply‑chain compromise, and exploitation of misconfigured guest access in SaaS platforms. Successful abuse of OAuth consent or guest settings can provide persistent delegated access (access tokens/refresh tokens) to mail, files, and other data without needing credentials. Recommended mitigations include tightening guest and third‑party app access,