FBI warns of Salesforce attacks by UNC6040 and UNC6395 groups

According to FLASH alert, the FBI warns of data theft and extortion campaigns by two cybercriminal groups, UNC6040 and UNC6395, increasingly targeting Salesforce platforms. Since early 2025, UNC6040 has used vishing and social engineering to induce Salesforce credential sharing and to approve malicious connected apps, enabling bulk data exfiltration via API queries and the use of OAuth tokens to bypass MFA.

The groups are linked to threat actors behind campaigns against Google, Cisco, Adidas, Qantas, and Allianz, with extortion emails sometimes following victims’ data exposure. The FBI notes that UNC6395 deployed compromised OAuth tokens for the Salesloft Drift app to compromise Salesforce instances, and that Salesloft revoked all tokens on 20 August 2025, cutting attacker access.

Since October 2024, the two groups have operated under different initial access mechanisms, exfiltrating data from Salesforce systems and using third‑party app integrations to facilitate theft. The alert urges organisations to enhance MFA, train call centre staff to recognise phishing, and monitor API usage and third‑party integrations to mitigate these attacks.