Do Son The FBI has issued a FLASH Alert warning about UNC6040 and UNC6395, two groups actively compromising Salesforce via vishing and malicious OAuth apps to steal data.
UNC6395
A major breach at Salesloft's Drift platform exposed customer authentication tokens, leading to unauthorized access of Salesforce data at over 750 companies.
A new report reveals a widespread data theft campaign targeting Salesforce instances. Attackers used compromised OAuth tokens from a third-party app to steal data and credentials.