Microsoft published a whole blog post this week telling customers how to defend against ShinyHunters. The irony is that most of what the crew is doing doesn’t require breaking anything. They’re calling your help desk, sounding like a stressed employee who lost their phone, and walking out with an OAuth token that your cybersecurity stack was never designed to question. No malware. No exploit chain. Just someone with a headset and a script.

That’s the story underneath this week’s news, and it’s worth sitting with, because it says something uncomfortable about where the industry has put its money versus where the actual bleeding is happening.

Your Guest Access Toggle Is Now Part Of Your Attack Surface

Microsoft’s writeup on ShinyHunters lays out three overlapping tactics: vishing, supply-chain compromise, and misconfigured guest access in SaaS applications. None of these are new individually. What’s new is how cleanly they chain together. A vishing call gets an OAuth consent granted or a password reset pushed through. Guest access, left wide open because someone needed a contractor to see a shared drive eighteen months ago, becomes the pivot point. And once the attacker is inside one tenant, the supply-chain angle lets them ride trusted app-to-app connections into everyone downstream.

Here’s the part that should bother you more than the vishing itself: none of this trips a traditional alert. Your firewall doesn’t see a phone call. Your endpoint detection doesn’t see an OAuth grant screen getting clicked “Accept” by a real, if fooled, employee. The entire attack lives in a layer most security teams still treat as a compliance checkbox rather than active terrain that needs the same threat detection rigor as your network edge.

Guest access in particular deserves a hard look. It’s the setting nobody remembers turning on, attached to the account nobody remembers creating, connected to the app nobody remembers approving. That’s not a hypothetical. That’s the default state of most mid-size SaaS environments right now.

The RabbitMQ Bug Proves The Same Point With Code Instead Of A Phone Call

If you want the non-human version of the exact same failure mode, look at the RabbitMQ vulnerability disclosed this week. Unauthenticated attackers could pull the broker’s OAuth client secret straight out of the system, no social engineering required, and use it to take over the broker outright. Same target category as ShinyHunters, OAuth trust, different delivery mechanism.

Put those two stories side by side and the pattern is obvious: OAuth secrets and tokens are being treated as internal plumbing when they should be treated as crown jewels. A hardcoded secret sitting in a message broker is just as dangerous as a token handed over on a phone call. Attackers don’t care which door was easier. They just walk through the open one.

Zimbra’s newly patched code execution flaw, where opening a crafted email is enough to run malicious code, is a reminder that the old-fashioned attack surface hasn’t gone anywhere either. But it’s telling that the flashier, more dangerous campaigns this week aren’t about tricking software. They’re about tricking the identity layer that software increasingly relies on to decide who gets trusted by default.

What To Actually Do About It This Week

None of this requires a forklift upgrade. It requires someone actually auditing the settings that got flipped on during a rushed vendor onboarding two years ago and never revisited. Treat this as an incident response exercise you run before there’s an incident, not after.

• Pull a full inventory of guest and external accounts across every SaaS tenant, then kill anything that hasn’t authenticated in 90 days.
• Require callback verification or a secondary identity check before your help desk resets credentials or re-enrolls MFA for anyone, no exceptions for “urgent” requests.
• Rotate OAuth client secrets on any exposed broker or middleware service, and stop storing them in config files that ship with default read permissions.
• Log and alert on OAuth consent grants the same way you’d alert on a new firewall rule, because functionally that’s what they are.
• Apply security hardening baselines to SaaS admin consoles specifically, not just endpoints and servers, since that’s where lateral movement between tenants actually happens.

Defense in depth used to mean stacking network controls. Now it has to mean stacking identity controls too, because that’s where the actual traffic is moving. A brute-force login attempt against a public-facing service is loud and easy to catch. A single successful vishing call that results in a legitimate-looking OAuth grant is quiet and looks exactly like normal business.

The Money Already Knows This Is The Problem

Look at where cybersecurity M&A dollars went in June. SecurityWeek’s roundup counted 37 deals, and identity plays were all over it, including moves from 1Password and SailPoint. Investors aren’t chasing OAuth and identity governance because it’s trendy. They’re chasing it because it’s the layer that’s actually failing in the field, over and over, across completely unrelated incidents.

That’s a useful signal if you’re trying to justify budget internally. You don’t need to argue that identity security is theoretically important. You can point at the exact same week’s headlines and show a nation-state-adjacent crime group using vishing and guest access abuse against SaaS platforms, and a broker vulnerability leaking OAuth secrets to unauthenticated attackers, and an acquisitions market that’s quietly betting big on fixing that gap.

The uncomfortable truth is that your organization probably has a decent firewall, a reasonable threat-protection stack, and a help desk that will reset an MFA token for someone who sounds panicked enough. Two out of three of those don’t matter if the third one is the weak point, and right now, it usually is.

Sources

• Defending SaaS-based applications against ShinyHunters OAuth abuse
• RabbitMQ Vulnerability Threatens Enterprise Systems
• Zimbra Patches Critical Code Execution Vulnerability
• Cybersecurity M&A Roundup: 37 Deals Announced in June 2026