FBI Releases IOCs on Cyber Threats Exploiting Salesforce for Data Theft

The FBI has released a detailed flash advisory disclosing indicators of compromise (IOCs) and tactics used by two cybercrime groups—UNC6040 and UNC6395—to breach Salesforce customer environments and siphon sensitive data. According to the bulletin, coordinated with the Department of Homeland Security Cybersecurity and Infrastructure Security Agency (DHS/CISA), the guidance is intended to help security teams detect, investigate, and thwart these campaigns.

Since October 2024, UNC6040 has relied heavily on social engineering voice phishing (vishing) to dupe call centre staff into granting access to Salesforce accounts, with attackers posing as IT support and steering victims through bogus service tickets to share credentials or MFA codes.

By contrast, UNC6395 leveraged compromised OAuth tokens associated with the Salesloft Drift chatbot application in August 2025, exploiting a valid token to access and exfiltrate customer data through the trusted integration before Salesforce and Salesloft invalidated active tokens on 20 August 2025. The advisory also publishes exhaustive IOCs, including IP addresses, URLs, and user-agent strings, to help defenders tune detection rules and monitor for bulk data extraction across cloud environments.