Loading story…
The FBI has issued a security advisory regarding ongoing attacks on Salesforce accounts by cybercrime groups UNC6040 and UNC6395. These groups use social engineering and credential theft to gain access, leading to data theft and extortion. The attacks have also impacted third-party services such as Salesloft Drift, affecting multiple organizations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
news.risky.biz
Open sourcesecurityaffairs.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI has released a FLASH alert warning organizations of ongoing data theft and extortion campaigns targeting Salesforce environments by cybercriminal groups UNC6040 and UNC6395. These groups use social engineering, vishing, and OAuth token abuse to gain access and exfiltrate sensitive customer data, impacting major global companies. The FBI provided indicators of compromise and recommended enhanced security measures, including staff training, MFA enforcement, and monitoring of API activity.
Jun 29, 2026The FBI has issued an alert about two threat groups, UNC6040 (ShinyHunters) and UNC6395, actively compromising Salesforce customers through vishing and OAuth token theft. Attackers use social engineering to gain access to Salesforce environments and exfiltrate sensitive data, sometimes leading to extortion attempts. The FBI recommends enhanced employee training, phishing-resistant MFA, and strict monitoring of third-party integrations to mitigate these threats.
Jun 29, 2026
The FBI warned that cybercriminal groups **UNC6040** and **UNC6395** compromised Salesforce environments to steal data and extort victims. UNC6040, active since at least October 2024, used vishing calls impersonating IT support to obtain credentials or MFA codes and persuade employees to authorize malicious Salesforce connected apps, often modified Data Loader tools, enabling bulk API exfiltration. Some affected organizations later received cryptocurrency extortion demands attributed to **ShinyHunters**. Separately, UNC6395 abused compromised OAuth tokens for the Salesloft Drift integration in a widespread August 2025 campaign; Salesloft and Salesforce revoked active Drift access and refresh tokens on August 20, 2025. The activity aligns with the financially motivated **The Com** ecosystem, a decentralized English-speaking criminal network associated with overlapping brands and participants including Scattered Spider, LAPSUS$, and ShinyHunters. Its operators commonly rely on help-desk impersonation, MFA fatigue, SIM swapping, adversary-in-the-middle phishing, identity-platform abuse, and SaaS/OAuth integrations rather than software exploits alone. Organizations should audit and remove unnecessary connected apps, rotate third-party integration credentials and tokens, restrict API and IP access, monitor Salesforce logs for abnormal bulk exports, enforce phishing-resistant MFA, and strengthen service-desk identity-verification and privileged-access processes.
Sep 29, 2026