A massive database leak containing over one million records of ZenBusiness customers has been disclosed on cybercrime forums. This threat intelligence report analyzes the complex SaaS-to-SaaS attack chain, OAuth device flow abuse, and critical remediation steps for protecting enterprise CRM and cloud databases.
High-risk SaaS lateral movement resulting in the exposure of over one million business records.
Attacker impersonates IT helpdesk to manipulate target admin
Attacker requests OAuth Device Flow; admin enters 8-char code on Salesforce portal
Rogue app is authorized, issuing valid access & refresh tokens that bypass MFA
Automated scripts search CRM database, extracting keys for Snowflake & Mixpanel
Bulk customer directories, tax IDs, and analytics records exfiltrated
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
June 21, 2026
A database leak involving 25 GB of customer data from Egypt-based consumer electronics giant Elaraby Group has surfaced online. Security teams must prioritize credential validation and session audits to defend against identity-driven access threats in the region.
An 8 GB SQL database archive has been leaked online, exposing sensitive student records, institutional identifiers, and emails. The incident highlights critical security gaps in public-facing educational platforms and the immediate danger of secondary credential abuse attacks across enterprise environments.
June 24, 2026
The emerging PEAR Team has leaked 1.8 TB of highly sensitive corporate and client records from Canada-based Exchange Group. Our detailed technical analysis exposes their data-only extortion tactics, RMM persistence methods, and actionable security telemetry to protect enterprise environments.
An extensive customer database containing approximately one million physical addresses, business registration records, employer identification numbers, and contact details has been compromised and made public, exposing critical enterprise data from the compliance platform ZenBusiness. This major incident highlights the significant risks surrounding third-party software-as-a-service configurations, which have become a primary target for sophisticated threat groups seeking direct access to high-value enterprise datasets without the need to breach traditional on-premise security perimeters. The exposure of these records represents a severe, immediate risk for companies requiring continuous protection across the GCC and international environments.
Unlike traditional database compromises that exploit unpatched software vulnerabilities or SQL injection flaws, this incident did not involve any direct software-level exploits in the core infrastructure of ZenBusiness. Instead, the threat actor group, tracked as UNC6040 or ShinyHunters, targeted the extensive trust relationships existing within the organization's integrated software-as-a-service ecosystem. By focusing on highly integrated systems such as Salesforce, Snowflake, and Mixpanel, the attackers successfully bypassed traditional security perimeters and accessed bulk customer databases.
Enterprise administrators should review the active integrations inside their CRM systems. In Salesforce, navigate to the Connected Apps OAuth Usage portal and audit all connected tools. Look specifically for apps that have been authorized via the Device Flow or those that request broad read and write permissions on user and lead tables. Any connection originating from an unapproved IP range should be immediately suspended, and its associated refresh tokens must be revoked.
Implementing anomaly detection on database queries is critical to preventing mass data theft. Security teams should configure alerts on unexpected spikes in API query volume, especially those targeting core demographic tables. Look for SOQL query patterns that utilize chunk-size modifications to bypass default export limitations, or queries executed outside of standard business hours by service accounts.
The leak of this data, which cybercriminals allegedly exfiltrated during a coordinated campaign, is circulating widely across underground forums such as pwnforums.st, where threat actors associated with groups like ShinyHunters have publicized the database. For organizations reliant on third-party registration services, the availability of these specific business operational details on the dark web acts as a catalyst for downstream attacks, including corporate identity theft, financial fraud, and highly tailored social engineering campaigns targeting corporate executives. To mitigate the ongoing risk of domain exposure, executing a comprehensive check on leaked parameters is a critical initial step for any modern defense posture.
In the face of these sophisticated underground distributions, security leaders must recognize that perimeter security alone is no longer sufficient. Identifying hidden exposure and compromised user sessions across public networks is a primary defensive priority. Our expert teams recommend implementing regular evaluations to uncover vulnerabilities within your integration ecosystem. To see if your corporate domains have already been exposed in this or other underground database leaks, you can use the FemtoSec Dark Web Scanner for a rapid, real-time snapshot of your public exposure profile.
The execution of the attack chain began with a highly targeted voice phishing, or vishing, campaign. Threat operators contacted high-privilege administrators and helpdesk personnel, impersonating internal IT support technicians or software platform administrators. By leveraging psychological manipulation and fabricating urgent operational problems, such as a simulated multi-factor authentication failure or a ticketing system outage, the attackers convinced employees to participate in a verification process that compromised active user sessions.
Once the attackers established rapport, they initiated an OAuth 2.0 Device Flow authentication request from an external system, such as a local instance of Salesforce Data Loader. This process generated an eight-character verification code. The threat actors instructed the victim, who was a legitimate, authenticated administrator, to navigate to the official authentication portal and enter the provided code. By entering this code, the employee authorized a malicious connected application controlled by the threat group. This action generated persistent access and refresh tokens that bypass multi-factor authentication and survive password rotations.
Using the hijacked API tokens, the attackers ran automated Python scripts and SOQL queries to systematically crawl the Salesforce environment and download millions of records. Inside the Salesforce platform, they discovered embedded configuration keys, credentials, and API connections linking the CRM to other analytics and storage environments, specifically Snowflake and Mixpanel. The threat group used these trust pathways to move laterally across the cloud environment, running bulk exports of registration lists, physical addresses, and tax identifiers directly into their own command and control servers.
Identifying the behavioral patterns of sophisticated groups like ShinyHunters requires mapping their tactics to standardized frameworks. Organizations should audit their environments against these specific MITRE ATT&CK techniques:
T1566.004 (Phishing: Voice Phishing): The threat group used deceptive telephone calls to convince internal administrators to authorize rogue devices and applications.
T1671 (Cloud Application Integration): The adversaries abused legitimate application authorization procedures to deploy a malicious connected app into the enterprise tenant.
T1528 (Steal Application Access Token): The attackers bypassed MFA controls entirely by acquiring legitimate OAuth access tokens through the device authorization flow.
T1020 (Automated Exfiltration): Automated scripts were deployed to run continuous, high-volume database queries without triggering standard rate-limiting controls.
T1213.004 (Data from Information Repositories): The attackers directly targeted cloud-based repositories, including CRM platforms and analytic databases, to aggregate target files.
To assist security operations centers in detecting potential activity related to this threat group, the following technical indicators have been identified in associated campaigns:
Mac/Firefox User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0
Agentic Scanning User Agent: Anthropic/RapeForceV2.01.39 (AGENTIC) AppleWebKit/537.36 (KHTML, like Gecko) FalconSensor/2025 Chrome/132.0.0.0 Safari/537.36
Associated Exfiltration IPs: 138.199.60.10, 54.251.184.9, 88.216.68.137, and 171.248.110.170
Threat Actor Extortion Contacts: [email protected] and [email protected]
Detecting token hijacking and lateral SaaS movement requires continuous log analysis and strict configuration validation. Security teams must move beyond endpoint alerts to monitor API activity and application integration logs.
Preventing OAuth hijacking and lateral cloud movement requires a proactive security approach. Modern enterprises cannot rely solely on basic password policies to protect integrated cloud services. To minimize vulnerability to these sophisticated techniques, security teams should implement the following architectural enhancements:
Enforce Strict API Access Controls: Restrict CRM API access so that only pre-authorized, administrator-approved connected applications are permitted to connect. Block all incoming integrations by default and enforce manual allow-listing.
Deploy Phishing-Resistant MFA: Move critical administrative accounts away from telephony-based MFA methods such as SMS or mobile TOTP. Enforce the use of physical FIDO2 keys for all administrators to prevent attackers from intercepting and inputting authentication codes.
Implement Network Restrictions: Configure IP restrictions and login IP ranges for all API access to ensure cloud databases can only be queried from corporate-controlled networks or secure VPN gateways.
Adopt Attack Surface Management: Regularly catalog all public-facing services and integrations. Utilizing specialized Attack Surface Management helps map out active connections and identify misconfigured cloud assets before they are exploited.
For organizations seeking to identify deep infrastructure weaknesses and validate their defense-in-depth posture, executing a thorough assessment of external integrations and administrative workflows is essential. To evaluate your current resilience against voice phishing and session hijacking, contact our specialists for an in-depth security analysis.
Free exposure check
Dark Web Scanner
check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.