Uncovering a Widespread Credential Theft Campaign

In June, Google announced that it had uncovered a large-scale campaign targeting Salesforce users. The attackers employed a social engineering approach, impersonating IT department personnel to deceive employees into granting unauthorized access. This scheme involved convincing employees that urgent issues required immediate account access, leading to widespread compromise.

Google Falls Victim to the Same Tactics

Remarkably, just two months later, Google revealed that it had also fallen prey to the same type of attack. This highlights how even major tech companies are not immune to sophisticated social engineering scams that exploit human factors rather than software vulnerabilities.

The Motivations Behind the Attacks

The threat actors behind these operations are financially driven, aiming to steal sensitive data for resale at premium prices. Instead of hacking through software flaws, they opt for direct communication—making phone calls and requesting access. This method has proven highly effective, as evidenced by breaches involving prominent organizations such as Adidas, Qantas, Allianz Life, Cisco, and luxury brands under the LVMH umbrella, including Louis Vuitton, Dior, and Tiffany & Co.

How the Scam Works: Exploiting Salesforce Features

The attackers leverage a legitimate Salesforce feature that allows users to link their accounts to third-party applications. These integrations facilitate data sharing with external tools like blogging platforms and mapping services. The scammers contact employees, instructing them to connect malicious external apps to their Salesforce accounts. Once the employee complies, the attackers request an eight-digit security code—the confirmation code Salesforce prompts before establishing a new connection. With this code, the scammers gain access to the entire Salesforce instance and all stored data.

Protecting Your Organization from Social Engineering Attacks

Organizations must implement strict security protocols and train employees to recognize social engineering tactics. Verifying the identity of callers, implementing multi-factor authentication, and establishing clear procedures for granting external access can significantly reduce the risk of such breaches.

Stay Vigilant and Secure

As cybercriminals refine their methods, continuous awareness and proactive security measures are vital. Regular audits of account access permissions and educating staff about common scam techniques can help defend against these evolving threats.

Ethan Cole

I'm Ethan Cole, a tech journalist with a passion for uncovering the stories behind innovation. I write about emerging technologies, startups, and the digital trends shaping our future. Read me on x.com