Most Important ShinyHunters Detection 2026: Salesloft/Drift OAuth Token Abuse from Anomalous IP
Detects unauthorized access to CRM platforms (Salesforce) using Salesloft or Drift OAuth tokens, where the source IP address does not match the known legitimate service provider IP ranges. This behavior is indicative of potential token theft or misuse, particularly relevant to supply-chain campaign activities.
YARA-L
