CyberSecurityBoardThreat Intel · CVEs · Products
Attack Groups

UNC6395: Threat Actor Group Linked to OAuth Abuse

June 25, 2026

UNC6395 is a threat actor group associated with prior OAuth abuse campaigns targeting Salesforce environments. The Klue incident shares similarities with their playbook.