Salesforce Email Services Zero-Day Flaw Exploited in Targeted Facebook Phishing Attack

Salesforce Email Services Zero-Day Flaw Exploited in Targeted Facebook Phishing Attack

A recent phishing attack exploited a zero-day flaw in Salesforce's email services to target Facebook users. The attack masqueraded as coming from Meta while being sent from an email address with a "" domain. The emails claimed that the recipient's Facebook account was undergoing a "comprehensive investigation" due to "suspicions of engaging in impersonation." The goal was to direct users to a rogue landing page to capture the victim's account credentials and two-factor authentication (2FA) codes.

The attack was notable for a few reasons:

  1. First, it exploited a zero-day flaw in Salesforce's email services. This means that Salesforce was unaware of the flaw during the attack and therefore had no patches available to protect its customers.
  2. Second, the attack was able to bypass traditional anti-spam and anti-phishing mechanisms. This was because the emails included legitimate links to Facebook and were sent from a legitimate email address of
  3. Third, the attack was targeted at Facebook users. This is a particularly vulnerable population, as many Facebook users are not as familiar with phishing attacks as other users.

The researchers who discovered the attack recommend that:

  • Users check the "From" email address for signs of fraudulence,
  • Watch for misspellings and incorrect grammar, and
  • Be suspicious of hyperlinks.
  • They also recommend being careful with all attachments and not opening questionable ones.

In addition to the tips provided by the researchers, here are some other things you can do to protect yourself from phishing attacks:

  • Use a strong password and enable two-factor authentication for your online accounts.
  • Be suspicious of emails that ask for your personal information, especially from an unfamiliar sender.
  • Do not click on links in emails unless you are sure they are legitimate.
  • Hover over email links to see the URL before clicking on them.
  • Keep your software updated, including your web browser and email client.
  • Be aware of the latest phishing scams and tactics. You can find information about common phishing scams on the websites of security organizations like the FBI and the Cyber Security & Infrastructure Security Agency (CISA).


  1. (n.d.). Phishers Exploit Salesforce's Email Services Zero-Day in Targeted Facebook Campaign. The Hacker News. Retrieved August 9, 2023, from

Elevate Your Business Operations Through Unmatched IT Excellence: Choose Second Star Technologies

Are you ready to take your business to the next level with optimized IT infrastructure? Second Star Technologies can help.

We offer a wide range of IT services, including network management, security solutions, and 24/7 support. Our team of experts will work with you to understand your needs and develop a customized solution that will help you achieve your business goals.

With Second Star Technologies, you can be confident that your IT infrastructure is secure, reliable, and scalable. We'll help you free up your time and resources so you can focus on what you do best: growing your business.

Contact us today to learn more about how we can help you reach your full potential.

Brandon Phipps

Brandon Phipps


Brandon Phipps, owner of Second Star Technologies, specializes in Managed IT Services for SMBs in Bakersfield, CA. With over 23 years of experience, he offers expert solutions in cloud computing, cybersecurity, and network management. A committed community member and coach, Brandon excels in leading and innovating in tech and sports coaching. His dedication to local businesses and communities is evident in his hands-on, tailored approach to IT solutions.

Just released our FREE eBook, 20 Signs That Your Business is Ready for Managed ServicesDOWNLOAD