The FBI warned on September 12, 2025, that two cybercriminal groups—tracked as UNC6040 and UNC6395—were accessing Salesforce customer environments to steal data and extort organizations. The warning did not describe one Salesforce zero-day or prove that Salesforce’s core platform had been breached.
The groups used different access paths: UNC6040 reportedly relied on telephone-based social engineering and malicious connected-app authorization, while UNC6395 used compromised OAuth tokens associated with the Salesloft Drift integration. The FBI advisory is a continuing defensive warning for organizations that store customer, employee, financial or operational information in Salesforce.
As an Amazon Associate I earn from qualifying purchases.
The two campaigns used different routes into Salesforce
| Threat cluster | Reported access path | Primary risk |
|---|---|---|
| UNC6040 | Vishing, phishing, stolen credentials or MFA codes, and malicious connected-app authorization | Direct Salesforce access and bulk API data theft |
| UNC6395 | Compromised OAuth access and refresh tokens linked to Salesloft Drift | Trusted third-party integration access to Salesforce data |
The FBI’s advisory, FLASH-20250912-001, was coordinated with DHS/CISA and marked TLP:CLEAR. It identified observed tactics and indicators of compromise, but did not establish that every Salesforce customer was affected or provide one universal victim or record count.
How UNC6040 reportedly operated
The FBI said UNC6040 activity had been observed since October 2024 and commonly began with a phone call to a victim organization’s call center. The caller impersonated IT support, often claiming to be handling a connectivity problem or automatically generated ticket.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The attackers reportedly persuaded employees to disclose credentials, visit phishing pages, provide MFA codes or authorize an application. In some cases, the application was a modified version of Salesforce Data Loader. Once authorization was granted, the attackers used Salesforce API queries to extract large volumes of data.
This was not a technical defeat of MFA. Rather, the reported workflow manipulated users into supplying an MFA code or approving an application. The resulting OAuth access could then continue to provide access and make activity resemble traffic from a trusted Salesforce integration. That is why a password reset alone may not end the intrusion.
How UNC6395 differed
UNC6395 used a separate campaign involving the Salesloft Drift integration, an AI chatbot that could connect to Salesforce. According to the FBI, attackers used compromised OAuth access and refresh tokens associated with Drift to access Salesforce customer instances and exfiltrate data during August 2025.
Recommended Free Tools
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The FBI said Salesforce and Salesloft revoked active Drift access and refresh tokens on August 20, 2025. Salesforce’s later customer notice characterized the incident as a compromise of the application’s connection credentials, not a vulnerability in the Salesforce core platform. That notice also said Salesforce disabled Drift’s Salesforce connection on August 28, 2025, while other Salesloft integrations were later re-enabled.
A legitimate integration can still become a high-value attack path. Once its credentials or tokens are compromised, the application may have permission to read substantial CRM data without the attacker needing to log in as an ordinary Salesforce user.
Was Salesforce itself hacked?
“Salesforce was hacked” is too broad a description of the evidence in the FBI and Salesforce notices. The reported incidents involved different forms of access:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- UNC6040 allegedly abused users, credentials, MFA codes and connected-app authorization.
- UNC6395 allegedly abused OAuth tokens belonging to a third-party integration.
- Salesforce’s later notice said the Drift incident did not result from a vulnerability in the Salesforce core platform.
The impact could nevertheless be serious. The amount and type of exposed information depended on each organization’s Salesforce objects and fields, user permissions, connected-app scopes, retention practices and integration architecture. Potentially sensitive records could include customer or partner information, employee data, financial details, operational documents and secrets mistakenly stored in CRM fields.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The FBI advisory does not establish one overall number of stolen records. Claims about very large totals should not be treated as confirmed unless independently verified and clearly attributed.
What Salesforce administrators should do now
- Review connected-app activity. In Salesforce, open Setup → Connected Apps → OAuth Usage. Review applications, users, timestamps and unfamiliar access. Export relevant information where possible.
- Revoke suspicious access. Salesforce administrators can revoke sessions, block or uninstall an application, or revoke current sessions for an app. Salesforce’s guidance is available in its connected-app session documentation.
- Revoke all application tokens. Do not assume that removing one visible session is enough. Use Salesforce’s OAuth access-management guidance and revoke all relevant access and refresh tokens. Salesforce documents a revocation endpoint at
https://MyDomainName.my.salesforce.com/services/oauth2/revoke. - Rotate affected secrets. Change API keys, OAuth secrets, access tokens, refresh tokens and credentials for affected integrations. Also check downstream systems and Salesforce records for exposed credentials or secrets.
- Preserve evidence before making destructive changes. Save relevant logs and coordinate with security, legal, privacy, insurance and incident-response teams before deleting apps or records where practical.
- Investigate multiple telemetry sources. Correlate Salesforce login history, API activity, connected-app usage, identity-provider records, browser sessions, bulk exports and downstream data-transfer logs.
- Report suspected criminal activity. Organizations with evidence of unauthorized access should consider reporting it to the FBI’s Internet Crime Complaint Center or a local FBI field office.
If an application no longer appears in the current OAuth Usage view, that does not prove it never accessed the organization. Review historical Salesforce and identity-provider logs, browser history and vendor records.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Restrict Data Loader and other connected apps carefully
Salesforce documents two main ways to limit Data Loader access. An organization can remove a user’s API Enabled permission, although that may disrupt other integrations, Salesforce mobile functions or legitimate administrative workflows. Alternatively, administrators can restrict the relevant connected app by changing Permitted Users from All users may self-authorize to Admin approved users are pre-authorized, then granting access through profiles or permission sets.
The second approach is often more targeted: approve named users and documented integration identities rather than disabling API capability indiscriminately. See Salesforce’s Data Loader restriction guidance and connected-app OAuth policies.
Free tools Windows power users keep installed
One-click scans. No signup required.
Hardening measures
- Use phishing-resistant MFA wherever possible.
- Train call-center and help-desk employees to reject unsolicited requests for passwords, MFA codes or application approvals.
- Inventory every third-party application with Salesforce access and review its OAuth scopes.
- Require administrator approval for connected apps where operationally feasible.
- Apply least privilege to users, integration identities and Data Loader operators.
- Set refresh-token expiration policies instead of leaving tokens valid until manually revoked.
- Use IP restrictions where appropriate.
- Monitor unusual bulk API queries, export volume, object access and session patterns.
- Create an approval process for new connected apps and OAuth-scope changes.
Salesforce Shield may provide deeper native audit, event-monitoring, encryption and governance capabilities for larger or regulated organizations, but it does not by itself prevent a user from authorizing a malicious app or stop a social-engineering call. SIEM and managed-detection services can correlate Salesforce, identity, endpoint and network telemetry, but they require appropriate logging and configuration. No commercial product is a guaranteed fix for this attack pattern.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Indicators of compromise
The FBI advisory contains the full IP addresses, URLs, Salesforce setup or connect paths and user-agent information associated with the reported activity. Administrators should use the complete FBI IOC list for threat hunting rather than relying on a shortened list in an article.
Notable UNC6395 user-agent strings cited by the FBI include Salesforce-Multi-Org-Fetcher/1.0, Salesforce-CLI/1.0, python-requests/2.32.4 and Python/3.11 aiohttp/3.12.15. These are not conclusive signatures: legitimate tools and scripts can use similar values, and an IOC match must be evaluated alongside application approvals, users, timestamps, API behavior and data access.
Quick Recap
What organizations should not assume
- A password reset alone invalidates every Salesforce OAuth token.
- MFA prevents a user from being tricked into approving a malicious application.
- A familiar or legitimate integration is automatically safe.
- A missing current token proves there was no historical access.
- An IP address or user-agent match alone proves UNC6040 or UNC6395 activity.
- The Drift containment measures eliminate the broader risks of vishing, malicious OAuth authorization or stolen integration tokens.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
