Loading story…
The FBI has issued an alert about two threat groups, UNC6040 (ShinyHunters) and UNC6395, actively compromising Salesforce customers through vishing and OAuth token theft. Attackers use social engineering to gain access to Salesforce environments and exfiltrate sensitive data, sometimes leading to extortion attempts. The FBI recommends enhanced employee training, phishing-resistant MFA, and strict monitoring of third-party integrations to mitigate these threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Grubhub disclosed that it suffered a breach connected to the wave of attacks targeting Salesforce environments and associated extortion activity. The confirmation publicly tied Grubhub to the broader incident cluster and established it as an affected victim.
Initial story creation
The FBI issued a warning about data theft targeting Salesforce instances and linked the activity to ShinyHunters. The alert marked an early official acknowledgment of the campaign and its suspected attribution.
Workday said it was affected by two related 2025 incidents involving its Salesforce CRM environment, including a social-engineering campaign tied to ShinyHunters/UNC6040 and a separate Salesloft Drift integration compromise. The company said exposed data included business contact information and, in the Drift incident, a limited subset of support case details and related metadata, while its core HR, payroll, and financial systems were not compromised.
7 references tracked. Mallory keeps watching after this page renders.
security.org
Open sourceinfosecurity-magazine.com
Open sourcecybernews.com
Open sourcesalesforceben.com
Open sourcedarkreading.com
Open sourcebleepingcomputer.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI has released a FLASH alert warning organizations of ongoing data theft and extortion campaigns targeting Salesforce environments by cybercriminal groups UNC6040 and UNC6395. These groups use social engineering, vishing, and OAuth token abuse to gain access and exfiltrate sensitive customer data, impacting major global companies. The FBI provided indicators of compromise and recommended enhanced security measures, including staff training, MFA enforcement, and monitoring of API activity.
Jun 29, 2026The FBI has issued a security advisory regarding ongoing attacks on Salesforce accounts by cybercrime groups UNC6040 and UNC6395. These groups use social engineering and credential theft to gain access, leading to data theft and extortion. The attacks have also impacted third-party services such as Salesloft Drift, affecting multiple organizations.
Jun 29, 2026
The FBI warned that cybercriminal groups **UNC6040** and **UNC6395** compromised Salesforce environments to steal data and extort victims. UNC6040, active since at least October 2024, used vishing calls impersonating IT support to obtain credentials or MFA codes and persuade employees to authorize malicious Salesforce connected apps, often modified Data Loader tools, enabling bulk API exfiltration. Some affected organizations later received cryptocurrency extortion demands attributed to **ShinyHunters**. Separately, UNC6395 abused compromised OAuth tokens for the Salesloft Drift integration in a widespread August 2025 campaign; Salesloft and Salesforce revoked active Drift access and refresh tokens on August 20, 2025. The activity aligns with the financially motivated **The Com** ecosystem, a decentralized English-speaking criminal network associated with overlapping brands and participants including Scattered Spider, LAPSUS$, and ShinyHunters. Its operators commonly rely on help-desk impersonation, MFA fatigue, SIM swapping, adversary-in-the-middle phishing, identity-platform abuse, and SaaS/OAuth integrations rather than software exploits alone. Organizations should audit and remove unnecessary connected apps, rotate third-party integration credentials and tokens, restrict API and IP access, monitor Salesforce logs for abnormal bulk exports, enforce phishing-resistant MFA, and strengthen service-desk identity-verification and privileged-access processes.
Sep 29, 2026