FBI Warns of Threat Actors Hitting Salesforce Customers

According to the FBI's Internet Crime Complaint Center (IC3), two threat actors, UNC6040 (also known as ShinyHunters) and UNC6395, are targeting Salesforce customers to steal data and extort victims. Since October 2024 UNC6040 has carried out social engineering attacks—principally vishing—to access organisations’ Salesforce accounts, with attackers posing as IT staff and manipulating call-centre staff to gain access and exfiltrate data.

The group has also used phishing pages and API calls, and has duped organisations into authorising malicious apps, sometimes a modified version of Salesforce’s Data Loader, to bypass authentication and harvest large amounts of sensitive data. UNC6395 is noted for stealing OAuth tokens from Salesloft’s Drift application, which has a Salesforce integration; on 20 August, Salesloft, in collaboration with Salesforce, revoked all active tokens and terminated access to victims’ Salesforce platforms connected via Drift.

The advisory says campaigns have affected broader Salesforce integrations beyond Drift, and that there is no Salesforce platform vulnerability involved. Recommended mitigations include phishing-resistant MFA, IP-based access restrictions, monitoring of logs, and reviewing third-party connections.