#Salesforce
All CosmicBytez Labs articles tagged #Salesforce, across news, security advisories, how-to guides, and projects.
- News
From Email-to-Case to the Boardroom: How Inherited AI Agents Break Governance Built for Software
Email-to-Case and Web-to-Case let anonymous senders reach Salesforce Agentforce AI agents, exposing governance gaps vendor reviews and prompt filters both miss.
- News
OAuth Grants Pile Up Faster Than You Can Review Them — Here's How to Keep Up
OAuth grants are piling up faster than security teams can review them, and the Klue breach shows how one forgotten credential exposed data at dozens of firms.
- News
'SalesBleed' Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration
Three Salesforce Agentforce flaws, dubbed SalesBleed, let attackers exfiltrate CRM data and hijack agents for phishing with zero clicks.
- News
'Salesbleed' Exploits Salesforce Agentforce to Enable Anonymous Slack Phishing
Zenity Labs: chained Agentforce flaws let attackers bleed CRM data via Web-to-Lead forms, then hijack a trusted agent to phish staff in Slack.
- News
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Dubbed 'City Forum,' a single threat actor has been silently scraping customer portals across Salesforce and ServiceNow for over a year.
- Security
CVE-2026-15162: WordPress Object Sync for Salesforce — SQLi via REST API
High-severity unauthenticated SQL injection in Object Sync for Salesforce plugin allows attackers to extract data via a misconfigured REST API push endpoint.
- News
"City-Forum" Data-Theft Attacks Target Salesforce and ServiceNow Portals
A 17-month stealth campaign uses custom Go tooling to scrape enterprise data from misconfigured Salesforce and ServiceNow guest-user portals.
- News
Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity
Microsoft has detailed three distinct attack paths used by actors aligned with ShinyHunters to infiltrate corporate Salesforce environments over the past...
- News
More Klue Breach Victims Identified as Hackers Get Hacked
Roughly two dozen companies have notified their customers of impact from the Klue-Salesforce breach incident — a cascade that now includes the hackers...
- News
LastPass Confirms Data Breach in Klue Supply Chain Attack
The Icarus extortion group compromised Klue, an AI-powered competitive intelligence platform, harvesting OAuth tokens to drain CRM data from hundreds of...
- News
Scope of Salesforce Attacks Expands as Icarus Leaks Stolen Data
More victims have surfaced after attackers breached application vendor Klue and abused its OAuth tokens to access customers' Salesforce environments. The...
- Newsletter
June 23 Digest: FortiBleed, Klue/Salesforce Supply Chain, Squidbleed, GitHub Actions Fix
A Russian IAB harvests 110M credentials from FortiGate firewalls; the Icarus group drains hundreds of Salesforce orgs via Klue OAuth tokens; a 29-year-old...
- News
Cybersecurity Firms Impacted by Klue Supply Chain Attack
The hackers exfiltrated data from Salesforce instances of Klue customers, including Huntress and Recorded Future, in a cascading supply chain compromise.
- News
Klue OAuth Breach Victim List Grows as Icarus Hackers Claim Attack
Market intelligence platform Klue has confirmed attackers stole OAuth tokens connected to customers' Salesforce environments, as the Icarus extortion...
- News
Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data
Salesforce has disabled the Klue Battlecards app integration following a security incident in which attackers abused OAuth tokens to access customer CRM...
- News
Klue OAuth Breach Linked to 'Icarus' Salesforce Data Theft Attacks
Market intelligence platform Klue suffered an OAuth breach that enabled the 'Icarus' threat actors to steal Salesforce CRM data from multiple...
- News
Salesforce Data Thefts Continue via Klue App Compromise
Klue's Battlecards competitive intelligence application has become the third integrated app compromised in the ongoing Icarus campaign targeting...
- News
Infinite Campus Data Breach Affects 137,000 School Staff Accounts
The ShinyHunters extortion gang stole personal information from over 137,000 school staff accounts via a Salesforce data theft attack targeting the widely...
- News
7-Eleven Data Breach Confirmed After ShinyHunters Ransom
7-Eleven has confirmed a data breach after ShinyHunters claimed to have stolen more than 600,000 Salesforce records containing personal information and...
- News
Microsoft, Salesforce Patch AI Agent Data Leak Flaws
Prompt injection vulnerabilities in Salesforce Agentforce and Microsoft Copilot would have allowed unauthenticated attackers to exfiltrate sensitive CRM...
- Newsletter
Mar 11 Digest: npm Supply Chain Seizes AWS Admin, 3.4M
This week: UNC6426 weaponizes a stale npm supply chain compromise to seize full AWS admin in 72 hours, Cognizant TriZetto leaks 3.4 million patient...
- News
ShinyHunters Claims Mass Data Theft From 400 Firms via Salesforce Aura
Cybercrime group ShinyHunters claims to have exploited misconfigured Salesforce Experience Cloud instances to steal CRM data from approximately 400...