Hackers exploit Salesforce email zero-day for Facebook phishing campaign

Attacks stole 2FA codes, too

clock • 3 min read
Hackers exploit Salesforce email zero-day for Facebook phishing campaign

Guardio Labs researchers have uncovered a sophisticated phishing campaign that took advantage of a zero-day in Salesforce email services and SMTP servers, enabling malicious actors to specifically target Facebook users.

The threat actors used a vulnerability named "PhishForce" to conceal malicious email traffic in Salesforce's legitimate email gateway services, capitalising on Salesforce and Meta's size and reputa...

To continue reading this article...

Join Computing

  • Unlimited access to real-time news, analysis and opinion from the technology industry
  • Receive important and breaking news in our daily newsletter
  • Be the first to hear about our events and awards programmes
  • Join live member only interviews with IT leaders at the ‘IT Lounge’; your chance to ask your burning tech questions and have them answered
  • Access to the Computing Delta hub providing market intelligence and research
  • Receive our members-only newsletter with exclusive opinion pieces from senior IT Leaders

Join now

 

Already a Computing member?

Login

You may also like
Dell confirms data breach affecting 49m people

Hacking

No financial info stolen, but names and addresses were leaked

clock 10 May 2024 • 2 min read
'Levelling up cybersecurity is a team effort,' says Jacob DePriest of GitHub

Open Source

But security starts with developers, and AI isn’t going to replace them

clock 09 May 2024 • 5 min read
Cybersecurity Festival 2024: Four ways to cut your cyber insurance premiums

Finance

Certifications mean nothing without action

clock 08 May 2024 • 4 min read

Sign up to our newsletter

The best news, stories, features and photos from the day in one perfectly formed email.

More on Threats and Risks

Russian network found using genAI to spread disinformation

Russian network found using genAI to spread disinformation

CopyCop aims to fuel discord and weaken support for Ukraine

clock 10 May 2024 • 2 min read
'TunnelVision' bug potentially allows snooping on all VPNs

'TunnelVision' bug potentially allows snooping on all VPNs

Operating system features can be manipulated to divert traffic away from encrypted VPN tunnel

clock 08 May 2024 • 3 min read
Bots now account for half of all web activity

Bots now account for half of all web activity

Nearly half of internet traffic is now automated, with malicious bots on the rise

clock 07 May 2024 • 3 min read