As the cyberthreat landscape evolves, attackers like Scattered Spider (UNC3944) and ShinyHunters (UNC6040) are increasingly focusing on Salesforce. This session uncovers five attack techniques, including a novel one, and demonstrates how adversaries exploit Community Sites, OAuth apps, shadow admin paths, and insider activity—along with practical ways to detect and prevent them.