FBI Shares IoCs for Recent Salesforce Intrusion Campaigns

The FBI has shared IoCs for two Salesforce-targeting intrusion campaigns, tracked as UNC6040 and UNC6395, which involve data theft and extortion from Salesforce customers. The first campaign uses vishing to persuade employees to grant access or share credentials, with some operators guiding victims to approve a modified Salesforce Data Loader variant to access stored data; after exfiltration, they issue extortion demands in cryptocurrency.

The FBI notes that UNC6040 has claimed affiliation with the ShinyHunters extortion group. The second operation, linked to UNC6395, targets the Drift AI chatbot integration with Salesforce and affected more than 700 organisations, with attackers using compromised OAuth tokens exfiltrated from Drift’s AWS instance following access to Salesloft’s GitHub account between March and June 2025.

Dozens of cybersecurity firms have disclosed breaches tied to the campaign, including recent confirmations from HackerOne and Qualys. As guidance, the FBI urges phishing-resistant MFA, training for call centres, AAA systems, IP-based access restrictions, log monitoring, and thorough vetting of third-party integrations, according to alert.