Salesforce infrastructure abuse: Stopping email scams and spam sent via SFDC · Blog · Sublime Security

Sublime's Attack Spotlight details multiple, active email campaigns that leverage legitimate Salesforce infrastructure to conduct spam, credential- and callback-phishing, and crypto wallet theft (including impersonation, redirect chains through Salesforce and free hosting like Cloudflare pages, and phishy CTAs). The report presents example messages, recurring signals (infrastructure abuse, redirects to free pages, brand impersonation, urgency, generic greetings), and the detection signals and AI-driven mitigations used to block these attacks.