Key Insights
Salesforce scam email campaigns exploit trust tied to a widely used enterprise platform. With more than 150,000 organizations relying on Salesforce for critical business operations, the platform's brand authority and deep integration into daily workflows make it a high-value target for social engineering.
These campaigns leverage authenticated sending infrastructure, familiar product language, and routine operational urgency to bypass scrutiny at every level. FBI alerts that it makes detection harder because technical trust signals can appear valid even when the underlying request is not, and conventional security tools may have little reason to intervene.
Key Takeaways
- Salesforce scam email campaigns exploit trusted infrastructure, allowing messages to pass SPF, DKIM, and DMARC checks legitimately rather than spoofing them.
- Multiple documented campaigns have used distinct techniques, including Email-to-Case abuse, vishing-led OAuth authorization, and OAuth token theft through a supply chain compromise.
- Email gateways (SEGs) often struggle with these attacks because their core detection model emphasizes infrastructure reputation, authentication results, and known-bad signatures.
- Abnormal uses behavioral AI in email to help identify Salesforce brand impersonation by analyzing identity, communication patterns, and content context.
- Effective defense depends on layered controls, including phishing-resistant MFA, OAuth governance, help desk verification protocols, and email security that adds behavioral context.
Why Salesforce Scam Email Campaigns Exploit Trust
The core issue is simple: documented Salesforce scam email campaigns abuse legitimate platform trust, which weakens the value of traditional trust signals.
Salesforce-themed attacks differ from conventional phishing because the campaigns described here use the platform's trust architecture instead of relying on an obvious technical exploit. Attackers take advantage of Salesforce's legitimate sending infrastructure, brand authority, OAuth framework design, and the routine urgency that a mission-critical CRM platform creates inside organizations.
Authentication checks can be technically accurate while still offering limited help for threat detection:
- Sender Policy Framework (SPF) confirms the sending IP is authorized.
- DomainKeys Identified Mail (DKIM) validates the cryptographic signature.
- Domain-Based Message Authentication, Reporting and Conformance (DMARC) confirms alignment.
Those signals validate the infrastructure, but they do not explain whether the message fits the expected relationship, workflow, or requested action. Employees are also conditioned to respond quickly to Salesforce-related communications to avoid disruption to sales operations, which gives attackers useful pretext for lures tied to case numbers, compliance issues, or account suspension notices.
How Salesforce Scam Email Campaigns Use Legitimate Infrastructure
Documented campaigns show that attackers can abuse multiple Salesforce-related workflows while still appearing operationally normal.
Email-to-Case Abuse for Authenticated Phishing
This campaign shows how a legitimate Salesforce feature can become an authenticated phishing channel. Researchers disclosed the PhishForce campaign after attackers exploited Salesforce's Email-to-Case feature, a legitimate function that converts incoming customer emails into support tickets.
Attackers created a new inbound email address on the salesforce.com domain, set it as an Organization-Wide Email Address, and used a verification bypass to send phishing emails impersonating Meta Platforms. Because the emails originated from Salesforce mail servers, authentication checks passed and the messages landed directly in inboxes.
Vishing-Driven OAuth App Authorization
This campaign shows how voice-based social engineering can turn a trusted Salesforce workflow into account access. UNC6040 vishing Callers impersonated IT support staff and guided employees through Salesforce's Connected App setup page to authorize a malicious renamed version of Salesforce's Data Loader. Once approved, the app generated OAuth tokens that evaded MFA because OAuth authorization relied on the user's existing authenticated session. Victim scope
Supply Chain OAuth Token Theft
This campaign shows how token theft can extend access after the initial compromise. UNC6395 compromise The attackers extracted OAuth tokens from the Drift AI chatbot integration, and those tokens provided API access without a new password or MFA challenge. Token validity Public reporting identified multiple affected organizations.
Why Traditional Email Security Misses Salesforce Scam Emails
Salesforce scam email campaigns often evade conventional detection because many controls are tuned to score infrastructure and known indicators, not surrounding behavior.
SEGs and rule-based filters were built for a threat model in which malicious actors commonly relied on malicious infrastructure. Salesforce-themed campaigns strain that model across several detection layers.
Authentication Protocols Validate Infrastructure
Clean authentication results can still leave defenders with little context about intent. When attackers send phishing through Salesforce infrastructure, whether through a compromised tenant or feature abuse, authentication results can still appear clean. That creates a structural blind spot for organizations that heavily trust Salesforce traffic or broadly allowlist its sending infrastructure.
Reputation Systems Score Shared Platforms
Shared-platform reputation does not identify which tenant or account is abusing the service. IP and domain reputation systems score infrastructure, not the individual tenant or account operating through it. Salesforce sending IPs benefit from years of legitimate business use, so reputation-based defenses may not distinguish between trusted platform infrastructure and a compromised or abused tenant using that same infrastructure.
Signature-Based Detection Trails Novel Campaigns
Novel campaigns often stay ahead of signatures during the earliest stages of abuse. Fresh redirect domains, new certificates, and newly compromised tenants can remain invisible to signature-based tools until defenders have already seen the campaign. When the sending phase itself uses trusted infrastructure, the infrastructure behind the email may never become a useful blocklist indicator.
Content Scanning Can Miss the Real Request
Content analysis may miss the action the attacker is actually trying to trigger. Rule-based content analysis often evaluates isolated signals. It may miss the mismatch between the sender context, the message framing, and the action being requested. A Salesforce scam email that tells a recipient to call a phone number instead of clicking a link leaves little URL-based evidence for a content rule to inspect, which is one reason vishing-led attacks can move outside the strongest detection path of traditional email filters.
How Abnormal Adds Behavioral Context to Salesforce Scam Email Detection
The most useful signal in these campaigns is context, and Abnormal is designed to help surface that context within email.
Abnormal applies behavioral AI to evaluate whether a message aligns with expected identity, communication, and engagement patterns in the inbox. That helps in Salesforce scam email campaigns because surrounding behavior can reveal risk that infrastructure checks alone do not explain.
Modeling Sender Identity in Email
Sender identity patterns can help surface inconsistencies that authentication alone does not explain. Abnormal is designed to analyze known-good patterns for senders in cloud email, including workflow cadences, recipient behavior, timing, and engagement flows. When a Salesforce-impersonating message arrives, those patterns can help surface inconsistencies even if authentication passes. In practice, that means teams can evaluate whether the message matches the established email relationship and expected workflow.
Mapping Expected Communication Patterns
Recipient and relationship patterns can help identify targeting that does not fit normal email activity. Abnormal can also help identify unusual recipient targeting within email. A Salesforce-themed message sent to an employee who has never received Salesforce communications, or sent to functions outside the normal notification pattern, may not carry an obvious technical indicator for a legacy tool to match. Relationship and recipient-pattern analysis can make those deviations visible for review.
Evaluating Social Engineering Language
The language of the request often matters more than any single keyword. Abnormal's behavioral AI can help analyze the email-borne social engineering elements of these campaigns, including urgency, authority claims, and unusual action requests. That is useful when attackers use polished templates and familiar product language to avoid basic keyword triggers. Within email, the surrounding context of the request often matters more than any single phrase.
Checking Brand and Destination Alignment
Branding, sender identity, and destination should align if the message is legitimate. Abnormal can also help identify emails where the claimed Salesforce identity does not align with the linked destination or overall message context. A Salesforce-branded message with a suspicious verification destination is a strong example of how brand, sender, and requested action can diverge even when parts of the message appear legitimate.
While some documented campaigns also involve voice calls and OAuth activity inside Salesforce, those non-email steps require separate controls beyond email security. The inbox remains an important control point for the email and account-based elements of these scams.
Practical Defenses Against Salesforce-Themed Scam Email Attacks
Reducing risk from Salesforce scam email campaigns requires layered controls across identity, operations, and user process.
Technical Controls
These technical measures can help reduce exposure before a scam email becomes account access or data loss.
- Deploy Phishing-Resistant MFA: CISA guidance identifies FIDO keys as the most effective phishing-resistant MFA option. Organizations can enforce this at the identity provider level, not only within Salesforce.
- Govern Connected App Authorizations: Establish an approved allow-list of connected apps and block unlisted apps by default. Monitor audit logs for new registrations and build OAuth token revocation workflows.
- Enforce IP-Based Access Restrictions: Conditional access can help detect travel anomalies signals and trigger blocking or step-up authentication. Teams can also review access from commercial VPN services.
- Apply Least-Privilege CRM Access: Two-person approval for CRM data export and restrictions on API access and login locations can limit exposure after compromise.
Operational Procedures
Operational controls can help reduce the human and process gaps these campaigns exploit.
- Establish Help Desk Verification Protocols: Employees who receive unsolicited vendor support calls can disengage and reconnect through a pre-established out-of-band channel. For high-risk calls, response guidance notes live video identity proofing as a reliable method.
- Enable Salesforce Event Monitoring: Forward login history, API activity, data export events, and connected app activity to the SIEM. Prioritized alerts for bulk exports, new app authorizations, unusual regions, and after-hours API use can improve response speed.
- Run Vishing-Specific Red Team Drills: Standard phishing simulations focus on email delivery and may leave organizations with limited visibility into voice-based social engineering exposure.
User Awareness
User training is most useful when it reinforces process, not visual trust cues alone.
- Train on Process Adherence: Employees benefit from training that emphasizes out-of-band verification and approval workflows, even when a message looks authentic. The article's documented campaigns show why polished language and familiar branding are not reliable indicators of legitimacy.
Defend Against Salesforce Scam Email Campaigns
The practical takeaway is that trusted infrastructure does not guarantee a trustworthy message, so defenses need context as well as authentication.
Salesforce-themed attacks reflect a broader shift in how adversaries approach enterprise email and adjacent workflows. According to the FBI IC3 report, business email compromise (BEC) generated $2.77 billion in confirmed losses in 2024. These campaigns succeed because they operate within legitimate infrastructure and familiar workflows, which can leave conventional detection models with too little context.
Organizations can strengthen coverage by pairing existing controls with detection that evaluates who is communicating, whether the interaction fits established patterns, and whether the requested action makes sense for the recipient. Combined with phishing-resistant MFA, OAuth governance, and strong help desk verification procedures, Abnormal can help security teams address the email and account-based exposure these campaigns create.
Book a demo to see how Abnormal can help protect your organization from Salesforce scam email campaigns and other sophisticated brand-impersonation threats.
