Accessibility links

Facebook   X   LinkedIn   Email

FBI Warns: Cybercrime Groups Exploit Salesforce to Steal Data

By: Jim Stickley and Tina Davis
January 18, 2026

The FBI has issued a FLASH alert saying that two cybercriminal groups, UNC6040 and UNC6395, are actively targeting Salesforce instances. These attacks are about stealing data and extorting organizations — criminals steal sensitive information and then threaten to publish or otherwise misuse it unless paid. 

Each group has been using different methods:

UNC6040 is using social engineering/vishing (phone-based scams). It pretends to be IT support in organizations’ call centers, claiming there’s some system or connectivity issue. During those calls, the attackers trick employees into giving up credentials, MFA codes, or approving malicious connected apps. They also used fake or modified tools like a tampered with version of Salesforce’s Data Loader to pull out large batches of data.  

UNC6395 took a different route and gained access via compromised OAuth tokens tied to a third-party application called Salesloft Drift, which was integrated with Salesforce. By abusing those tokens, attackers could access victims’ Salesforce environments and exfiltrate data.  

Salesforce and Salesloft responded by revoking those compromised tokens and disconnecting risky integrations. 

Be aware of vishing—If you are answering phones or attending to support tickets, be aware of vishing (voice phishing) techniques. Verify calls before providing credentials or making changes. 

Use strong, phishing-resistant authentication—Where possible, use multi-factor authentication (MFA) methods that cannot be easily bypassed or shared. If an account allows MFA, enable it.

Implement the principle of least privilege. This may seem like it applies only to IT personnel, but it doesn’t. If there is any program or app that asks for permissions, give accounts only the permissions they need. Avoid giving administrative privileges unless absolutely necessary.

The FBI has a whole list of recommendations for IT organizations. Those can be found in the FLASH alert on the IC3 website by searching for FLASH-20250912-001.



Phone Scammers Use Big Tech As Lures

Mobile Security

Phone Scammers Use Big Tech As Lures

Ask a robocall recipient and they’ll tell you that robocalls are annoying and a waste of time. But the victim of a phone scam (vishing) will tell you it could mean losing a lot more than just time. Like email phishing, falling for a vishing scam can put you in danger of losing your identity, your money, and any other private information a criminal can get. So, what to do when the caller claims to be from a trusted business and has a legitimate reason to call? READ FULL STORY
Scattered Spider’s Web Of Lies, Deception And Ransomware

Your Security

Scattered Spider’s Web Of Lies, Deception And Ransomware

Warnings from the FBI and CISA came in loud and clear recently…Scattered Spider’s cyberattacks are more hazardous and crippling than ever before. Their high-profile, financially motivated attacks rely on social engineering for data theft, extortion, and ransomware attacks. And when both security agencies release a joint advisory warning to us about this threat group, it’s smart to listen. These threat actors made headlines for crippling financial attacks against several large organizations recently and they've increased the stakes playing their games. READ FULL STORY
53% In U.S. Use Digital Wallets, But Are They Safe?

Mobile Security

53% In U.S. Use Digital Wallets, But Are They Safe?

Digital wallets became a preferred way of paying for purchases since the coronavirus outbreak put them on the map. This easy way of making touch-free, germ-free payments morphed into the method of choice for 53% of shoppers in the U.S., according to a Forbes Advisor survey. But storing credit and other payment cards in a digital wallet raises concerns about the security of these payment apps. Let’s take a closer look so you can decide if using these, such as Apple Pay or Google Pay are a good choice for you. READ FULL STORY
Finally! Ways to Log In Without Passwords

Your Security

Finally! Ways to Log In Without Passwords

The time has come. Technology has finally appeared that all but eliminates the need to remember a whole bunch of different passwords. No more hint lists. No more trying to come up with yet another one for each site you use. All of that has finally become unnecessary, mostly. Now, you can use some other way to log in. There are many options and what you choose depends on how you are logging in, what you're using, and your own personal preference. The point is, you have choices. READ FULL STORY
Attackers Breach DropBox Sign Production Environment Accessing Login and Authentication Info

Identity Theft

Attackers Breach DropBox Sign Production Environment Accessing Login and Authentication Info

In April 2024, Dropbox reported a significant security breach involving its Dropbox Sign service, formerly known as HelloSign. The breach occurred on April 24, 2024, when a hacker accessed the production environment of Dropbox Sign through a compromised service account. This account, used for automated system configurations, allowed the attacker to infiltrate the system and access sensitive customer information. Dropbox is also in the process of notifying all affected users. READ FULL STORY




We use cookies to give you a more relevant browsing experience and improve our website. Using this site means that you agree with our use of cookies policy.