FBI Alert: Two Cybercriminal Groups Are Actively Compromising Salesforce

Two cybercriminal groups, UNC6040 and UNC6395, are actively compromising Salesforce instances to steal data and extort victims, according to the alert.

Since late 2024, UNC6040 has relied on voice phishing to trick call centre staff into sharing Salesforce credentials, with actors posing as IT support and closing auto-generated tickets to gain access, and key tactics including credential harvesting, API exploitation via Salesforce Data Loader, and deceiving victims into authorising rogue connected apps that bypass MFA.

UNC6395 has run a parallel campaign using compromised OAuth tokens linked to Salesloft Drift, with August 2025 seeing attackers exploit those tokens and third‑party app integration to exfiltrate data; Salesforce and Salesloft revoked all active Drift tokens on 20 August 2025.

The FBI urges defenders to review indicators of compromise and adopt measures such as phishing‑resistant MFA, least‑privilege access controls, monitoring of API and OAuth activity, rotating API keys and tokens, and training call centre staff to detect vishing attempts, according to the alert. Some victims of UNC6040 reportedly received extortion emails allegedly from the ShinyHunters group, demanding cryptocurrency payments to prevent leaks.

The alert also lists numerous IOCs including malicious domains, IP addresses, and user‑agent strings, and cautions these indicators should be correlated with broader activity. according to alert.