Hackers breach Salesforce instances of major corporations through voice phishing
Take action: Always verify any urgent call from "IT" or anyone representing authority. The urgent call technique paired with pressure tactics and abuse of the ability of most users to grant access to apps is extremely dangerous.
Learn More
A wide reaching social engineering campaign is targeting Salesforce customer relationship management (CRM) instances. The attack has compromised major corporations like Cisco, Chanel, Pandora, Google, KLM and Air France.
The attacks are attributed to the ShinyHunters. The hackers used voice phishing (vishing) techniques to persuade employees of the targeted companies to connect malicious versions of Salesforce Connected Apps to their Salesforce instance, granting access to hackers to the entire content of the CRM instance.
The attacks resulted in theft of the data stored on the respective Salesforce instances via the permissions granted to the malicious connected app.
Attack sequence:
- Target location: The hackers targeted English speaking employees within multinational corporations who would have access to grant permissions for a new Salesforce Connected Apps. It's very possible that sales and customer success senior people were targeted via a combination of linkedin scraping and stolen/scraped datasets to locate the phones of relevant employees.
- Phishing voice call - attackers impersonated internal IT support personnel and using various back stories including urgent IT issues or compliance deadlines guided the victims to navigate to Salesforce's Connected Apps setup page (see image above).
- Connecting a malicious app - The employees were instructed to enter an 8-digit connection code provided by the attacker during the phone call.
- Steal data - The entered code authorized a malicious OAuth application, typically a modified version of Salesforce's Data Loader tool, to access the organization's Salesforce environment. Once authorized, the malicious application granted the threat actors full access to query, export, and exfiltrate sensitive data directly from the compromised Salesforce customer environments.
The users were led to a trusted Salesforce URL, so one of the indicators of 'fake URL' was missing from the phishing call. So although unexpected, the call fro "IT" was probably trusted because the target was just instructed to open a trusted Salesforce URL.
Organizations globally should raise this event to their employees since the technique can be reused or adapted for various other scenarios. Granting access to an OAuth application is possible for the majority of cloud platforms, and this series of attacks confirms that the attack is very successful.
MFA and zero trust make no difference, because the user has granted permissions directly to another application.
Since the attack is partially low-tech (phone call), the counter measures are also commensurately low-tech. Organizations should consider call-back procedures or other verification when an ad-hoc request is received from someone representing IT or any authoritative function within the organization.
Organizations should also implement comprehensive monitoring of connected applications and OAuth authorizations, with automated alerting for new application connections.
