---
id: 3860
title: "SaaS Threats are Escalating: A Follow-Up to Our Recent Analysis"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/saas-threats-are-escalating-a-follow-up-to-our-recent-analysis"
published_at: "2025-10-14 00:00"
tags: ["salesforce", "oauth", "saas-security", "unc6040", "unc6395", "shinyhunters"]
phying_url: "https://phying.com/item/3860"
lang: en
---

# SaaS Threats are Escalating: A Follow-Up to Our Recent Analysis

## Summary

SaaS threat update: UNC6040 (ShinyHunters/Scattered Spider) runs credential attacks and OAuth phishing; suspected nation-state UNC6395 spread beyond Salesloft to 700+ customers.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2025-10-14 00:00
- **Original:** https://bishopfox.com/blog/saas-threats-are-escalating-a-follow-up-to-our-recent-analysis
- **Phying News:** https://phying.com/item/3860