The US Federal Bureau of Investigations (FBI) has put out a warning that cybercriminal groups have been targeting organizations’ Salesforce platforms.
In the alert, the FBI warned of increased data theft and extortion intrusions from two specific groups.
One of those groups is behind the recent Salesloft attack that opened a backdoor into Salesforce.
Hackers exploited compromised OAuth tokens for the Salesloft Drift application, an AI chatbot that can be integrated with Salesforce via API.
OAuth tokens are digital credentials that authorize secure API access to specific user data or services. The hackers used the compromised tokens and third-party app integration to compromise victims’ Salesforce systems and extract data.
Salesforce quickly worked with Salesloft to close the security loophole. On August 20, 2025, Salesloft revoked all active access from the tokens, stopping the hackers from being able to breach victims’ Salesforce platforms, the FBI said.
Yet, these criminal groups aren't only exploiting software integrations; they are also conducting phishing attacks on CRM users, like customer support reps.
Indeed, the FBI warns that malicious actors have also engaged in social engineering attacks, especially voice phishing (vishing), to gain access to organizations’ Salesforce accounts.
Here, the attackers have called organizations’ contact centers posing as IT support employees, responding to enterprise-wide connectivity issues. They trick customer support employees into taking actions that give them access to their devices and then use API queries to steal large volumes of customer data.
In some instances, like the recent Google's recent Salesforce breach, attackers directly requested employees’ login credentials and multifactor authentication (MFA) codes to authenticate and add a modified version of the Salesforce Data Loader application using OAuth tokens.
By asking employees to unknowingly install malicious apps, attackers can bypass traditional security defenses such as MFA, password resets, and login monitoring. And because the tokens are issued by Salesforce, the connected apps can appear to be trusted integrations, and hackers can register them without a legitimate corporate account, making them difficult to detect, the FBI said.
Some victims have received extortion emails days or months later that demand payment in cryptocurrency to avoid the stolen data being published, indicating that customers need to remain on guard for extended periods.
Why Salesforce Customers Should Be on Guard
With CRM platforms like Salesforce at the center of organizations’ customer data strategies, a single breach can have a knock-on effect across entire ecosystems of partners and customers.
Reflecting the significance of this threat, the American Hospital Association released a statement drawing attention to the FBI’s warning, as many hospitals and healthcare systems use Salesforce Health Cloud.