- Check Point Warns Salesforce tools used for phishing -attack
- The attacks use Facebook image as a lure
- The goal of the campaign is to steal Facebook -Login -AliGritimation information
Cyber criminals have been observed abuse by a legitimate Salesforce service to attack people and businesses with Facebook-related phishing emails.
Researchers at Check Point warned about the ongoing campaign on his blog and described how the criminals used the automated mailing service belonging to Salesforce as a marketing tool.
“In other words, they do not violate any Terms of Service or Salesforce security systems,” the researchers explained. “Rather, they use the service normally and choose not to change sender ID. In that way, the E mail is labeled with E -Mail –me address noreply [at] Salesforce [dot] com.
Fakebook
The body of the phishing -e email is nothing extraordinary. It’s the usual “Your Facebook account is under Revision” threat, where the victims are warned that their account will be suspended unless they “verify” their details. The e email shares a link to a fake Facebook support page where sensitive information, such as passwords, is stolen.
The landing page comes with a bad attempt at a Facebook logo (it says ‘Facelook’, where Crooks apparently wanted to make letters ‘lo’ to look like the letter ‘B’).
Check Point says that more than 12,200 of these E emails were sent so far, with “hundreds” targeting different companies. The majority of targets are in the EU (45.5%) and the US (45%), with the remaining 9.5%targeted at Australia.
“Nevertheless, versions of the notifications are also found in Chinese and Arabic, which shows that the campaign targeted companies across geographical sites,” Check Point emphasized.
Phishing remains one of the most popular attack vectors of 2025. It is cheap, scalable and ubiquitous, making it a great tool for cyber criminals. And with generative AI coming into the mixture, phishing has become the ideal way to trick victims to share login -credentials or install malware.
