FBI Releases IOCs on Cyber Threats Exploiting Salesforce for Data Theft

**FBI Advisory — OAuth-based Exfiltration Against Salesforce:** The FBI and CISA detail campaigns by UNC6040 (vishing to trick call-center staff into authorizing malicious connected apps) and UNC6395 (use of compromised Salesloft/Drift OAuth tokens) to gain persistent API access and exfiltrate customer data from Salesforce; the bulletin lists extensive IOCs (IP ranges, URLs, user‑agents) and recommends mitigations such as phishing‑resistant MFA, restricting third‑party integrations, IP restrictions, token revocation, and enhanced monitoring.