FBI Warns Salesforce Customers of Two Recent Intrusion Campaigns

The FBI has issued a FLASH alert for two ongoing cybercrime campaigns (tracked as UNC6040 and UNC6395), both focused on compromising Salesforce customer environments. The goal? To steal data and extort organizations.

Let's dive into what organizations can take away from this alert:

How the UNC6040 and UNC6395 Attacks Are Operating

The first step to prevention is understanding.

Our ethical hackers have summarized the tactics being leveraged throughout these recent cyberattacks:

UNC6040: The Utilization of Vishing and Malicious Data Loading Tactics

• Threat actors are utilizing voice phishing (vishing) to trick employees into handing over credentials or approving specially modified Salesforce Data Loader applications.

• In many cases, these attackers are impersonating internal IT support or use renaming tricks (for example, calling apps such as “My Ticket Portal”) to make malicious tools appear legitimate.

• After gaining access, they then perform large-scale exfiltration using API queries. The stolen data is later used in extortion demands, when victims are pressured to pay to "prevent leaks to the Dark Web."

UNC6395: Token Abuse via Salesloft and Drift Integration

• Between August 8th and 18th, 2025, UNC6395 used compromised OAuth (and refresh) tokens related to the Salesloft–Drift integration to access numerous Salesforce instances.

• Once inside, they didn’t just grab contact lists—they hunted for “secrets” like AWS keys, Snowflake access tokens, passwords, and other sensitive credentials stored in Salesforce objects.

• As such, many organizations affected had to revoke the compromised tokens, temporarily disable the Drift integration, and rotate credentials.

Why These Targeted Salesforce Campaigns Pose a Risk

The threat actors in question aren’t exploiting bugs in Salesforce itself; they’re exploiting trust relationships (OAuth, third-party apps, social engineering). That means even well-defended organizations can be blindsided.

With hundreds of organizations exposed via the UNC6395 Drift‐Salesloft campaign, there is a high likelihood that others may be affected but haven’t been publicly disclosed.

"I Was Impacted by the Salesforce Cyber Breach. What Should My Team Do Now?"

Initial steps your security, operations, and leadership teams can take to mitigate risks include, but are not limited to:

Broader Lessons for Technical Leaders and CISOs

• SaaS is not always “secure by default.” Even if the platform is robust, the way you integrate and permit connectivity often introduces risk.

• Trust relationships are attack vectors. OAuth tokens, third-party applications, and support privileges are low-hanging fruit for threat actors.

• Defenses must include people and processes, not just software. Vishing, social engineering, and human trust are recurring weak points. Technology alone won’t solve them without user training, policies, and controls.

• Security operations must include SaaS integration risk assessments. Regular audits of what third-party tools you allow, what permissions they have, and whether you truly monitor their behavior.

• Recovery is not just about patching; it’s about disruption readiness. If tokens are compromised, teams require fast mitigation: token revocation, communication, internal and external reporting, and recovery procedures.

Conclusion

The FBI’s alert about UNC6040 and UNC6395 underscores a critical trend: attackers are increasingly targeting the connective tissue of SaaS ecosystems (namely OAuth, third-party apps, identity, and trust.) '

These campaigns demonstrate that your Salesforce environment might be secure in isolation, but vulnerabilities in integrations and human behaviors can lead to serious compromise.

For security leaders, the takeaway is clear: strengthen your third-party integration hygiene, train people for social engineering attacks, monitor your OAuth/App usage carefully, and be ready for rapid response when incidents happen.

At Packetlabs, we specialize in helping organizations build resilience... including SaaS-ecosystem defense, integration risk audits, and incident response planning. When your defenses cover not only your systems but also your trust relationships and people, you're better positioned to prevent (and contain) these emerging threats.