FBI Warns Salesforce Users of Fresh Attacks

The FBI’s Alert & Two Major Threat Groups

On September 12, 2025, the FBI’s Internet Crime Complaint Center (IC3) released a FLASH advisory describing malicious campaigns targeting Salesforce user environments. [1]

The advisory names two threat actor clusters:

• UNC6040
• UNC6395

These groups are actively targeting Salesforce instances through different vectors—social engineering and compromised application integrations.

While Salesforce itself is not confirmed to have been directly hacked via a platform vulnerability, the attacks exploit the access paths around integrations, APIs, and user trust.

Attack Methods in Use

1. Voice Phishing (Vishing) & Social Engineering

UNC6040 has been observed using voice-based social engineering to trick support or help-desk staff. The attackers pose as IT or connectivity support, referencing “auto-generated tickets,” and request that the staff perform steps that grant them elevated access or credentials.

Typical tactics include:

• Asking employees to visit the Salesforce “connected apps” settings page
• Coaxing approval of a malicious connected app
• Requesting Multi-Factor Authentication (MFA) codes
• Deploying a modified version of Salesforce’s Data Loader tool to exfiltrate data
  These techniques can bypass conventional security measures like password resets or login monitoring, because the malicious app operates with an authorized OAuth token.

2. Compromised OAuth Tokens via Third-Party Tools

UNC6395 has used a different approach: infiltrating the Salesforce ecosystem by abusing compromised OAuth tokens tied to a third-party tool—Salesloft’s Drift chatbot.

In August 2025, threat actors used stolen OAuth tokens from the Drift integration to access Salesforce environments and siphon data. In response, Salesloft revoked all active and refresh tokens tied to Drift integrations.

Though that particular entry point was closed, the existence of a supply-chain or integration-based threat underscores a larger systemic weakness—any third-party app or integration is a potential attack vector.

3. Extortion After Data Exfiltration

Victims of both UNC6040 and UNC6395 have received extortion demands—usually in cryptocurrency—threatening public release of stolen data. In some cases, the threats arrive days or months after the breach.

Some of these extortion claims are associated with a group known as ShinyHunters or “ShinyHunters / Scattered Spider collaborations.”

Why Salesforce Users Are Being Targeted

Several factors make Salesforce a rich target for threat actors:

• Data concentration: Salesforce holds vast repositories of customer data, sales records, integration tokens, support tickets, and sensitive contacts.
• Trust in integrations: Because many organizations routinely authorize connected apps or integrate with third-party tools, malicious OAuth tokens may not trigger suspicion.
• Bypassing conventional controls: When attackers gain OAuth tokens or are authorized as “trusted apps,” they can often bypass MFA, login-rate-limits, or password-change defenses.
• Supply-chain risk: As seen via Salesloft’s Drift app, a compromise in a third-party system can cascade into Salesforce environments.
• Profit from extortion: Once data is stolen, it can be monetized through ransom, resale, or reputational harm.