After recent Salesforce-related incidents, the FBI has issued a flash alert detailing indicators of compromise (IoCs) linked to two (2) cybercriminal groups, UNC6040 and UNC6395, responsible for extensive data theft and extortion attacks targeting Salesforce environments. UNC6040, active since late 2024, employs vishing and social engineering tactics to trick employees into connecting malicious OAuth applications to Salesforce accounts, facilitating mass data exfiltration. This group has been associated with the ShinyHunters extortion network, targeting databases containing customer information for extortion purposes. UNC6395 carried out a widespread data theft campaign in August 2025, exploiting OAuth tokens from the Salesloft Drift application. The breach originated from compromised Salesloft GitHub repositories, allowing attackers to steal authentication tokens and access Salesforce instances to extract sensitive information. This impacted over 700 organizations, including Cloudflare, Zscaler, Palo Alto Networks, and many others. In response, Salesloft isolated Drift’s infrastructure and collaborated with Salesforce to revoke all Drift tokens. The attackers also accessed Drift Email tokens to infiltrate Google Workspace accounts. The FBI’s alert emphasizes the importance of implementing phishing-resistant multi-factor authentication, monitoring logs, and reviewing third-party integrations to fortify defenses. The ShinyHunters, Scattered Spider, and Lapsus$ groups are believed to be behind these operations, with recent announcements suggesting they plan to “go dark.” However, past patterns indicate such pauses are often temporary, and vigilance remains crucial. CTIX analysts recommend organizations incorporate the FBI’s list of IOCs into their network scanning tools.