Salesforce Email Services Zero-Day Flaw Exploited in Targeted Facebook Phishing Attack

A recent phishing attack exploited a zero-day flaw in Salesforce's email services to target Facebook users. The attack masqueraded as coming from Meta while being sent from an email address with a "@salesforce.com" domain. The emails claimed that the recipient's Facebook account was undergoing a "comprehensive investigation" due to "suspicions of engaging in impersonation." The goal was to direct users to a rogue landing page to capture the victim's account credentials and two-factor authentication (2FA) codes.

The attack was notable for a few reasons:

1. First, it exploited a zero-day flaw in Salesforce's email services. This means that Salesforce was unaware of the flaw during the attack and therefore had no patches available to protect its customers.
2. Second, the attack was able to bypass traditional anti-spam and anti-phishing mechanisms. This was because the emails included legitimate links to Facebook and were sent from a legitimate email address of @salesforce.com.
3. Third, the attack was targeted at Facebook users. This is a particularly vulnerable population, as many Facebook users are not as familiar with phishing attacks as other users.

The researchers who discovered the attack recommend that:

• Users check the "From" email address for signs of fraudulence,
• Watch for misspellings and incorrect grammar, and
• Be suspicious of hyperlinks.
• They also recommend being careful with all attachments and not opening questionable ones.

In addition to the tips provided by the researchers, here are some other things you can do to protect yourself from phishing attacks:

• Use a strong password and enable two-factor authentication for your online accounts.
• Be suspicious of emails that ask for your personal information, especially from an unfamiliar sender.
• Do not click on links in emails unless you are sure they are legitimate.
• Hover over email links to see the URL before clicking on them.
• Keep your software updated, including your web browser and email client.
• Be aware of the latest phishing scams and tactics. You can find information about common phishing scams on the websites of security organizations like the FBI and the Cyber Security & Infrastructure Security Agency (CISA).

References