https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving Salesforce.Sun, 26 Jul 2026 22:32:52 GMThttps://bleepingcomputer.com/news/security/claude-chrome-extension-flaw-lets-malicious-extensions-trigger-ai-actionscst-2716A vulnerability in Anthropic's Claude Chrome extension allows malicious extensions to simulate user clicks and trigger predefined AI actions without explicit user consent. The flaw could be exploited to abuse Claude's access to connected services including Gmail, Google Docs, Google Calendar, and Salesforce.Thu, 16 Jul 2026 19:26:07 GMThttps://helpnetsecurity.com/2026/07/16/valorc3-backup-as-a-service-baascst-2685ValorC3 Data Centers released a fully managed backup service for SaaS applications including Microsoft 365, Entra ID, and Salesforce, featuring immutable backup copies to protect against deletion, corruption, and ransomware. The service addresses a common misconception that cloud vendors automatically provide data backup protection. Recent governance research indicates 80% of organizations have encountered at least one cloud security incident.Thu, 16 Jul 2026 11:48:49 GMThttps://thehackernews.com/2026/07/microsoft-maps-year-long-shinyhunters.htmlcst-2455Microsoft researchers documented a year-long campaign in which attackers associated with ShinyHunters exploited trusted OAuth connections to Salesforce environments rather than targeting platform vulnerabilities. The attackers leveraged existing integrations between Salesforce and third-party applications to gain unauthorized access to corporate data across multiple attack paths.Tue, 14 Jul 2026 06:19:24 GMThttps://microsoft.com/en-us/security/blog/2026/07/13/defending-saas-based-applications-against-shinyhunters-oauth-abusecst-2451Microsoft identified ShinyHunters-associated threat actors conducting campaigns from mid-2025 to mid-2026 that abused OAuth relationships to compromise Salesforce and other SaaS applications across retail, education, and manufacturing sectors. The attackers used voice phishing to trick users into authorizing malicious apps, exploited supply chain compromises in third-party integrations like Salesloft, and leveraged misconfigured guest access to gain persistence and exfiltrate customer relationship management data. These intrusion paths operated within legitimate OAuth workflows, allowing the threat actors to inherit user privileges and evade conventional authentication detection without exploiting any Salesforce vulnerability.Mon, 13 Jul 2026 22:02:41 GMThttps://darkreading.com/cyberattacks-data-breaches/scope-salesforce-attacks-expands-icarus-leaks-datacst-116Attackers who breached application vendor Klue obtained OAuth tokens that enabled unauthorized access to Salesforce data belonging to Klue's customers. The scope of affected organizations has expanded beyond initial disclosures as additional victims are identified.Tue, 23 Jun 2026 20:44:09 GMThttps://huntress.com/blog/klue-breach-investigationcst-669Klue, a competitive intelligence platform, experienced a security breach that exposed Salesforce data from multiple vendors and customers, including Huntress. The incident affected an undetermined number of organizations that relied on Klue's services. Details about the breach scope and remediation efforts remain limited.Thu, 18 Jun 2026 07:00:00 GMThttps://reliaquest.com/blog/threat-spotlight-integration-abused-in-crm-data-theftcst-2117Attackers compromised the Klue integration in Salesforce to exfiltrate customer relationship management (CRM) data by abusing OAuth tokens and automated REST API queries. The activity follows a pattern seen in prior Salesforce third-party compromises affecting Salesloft, Drift, and Gainsight throughout 2025 and 2026. A Telegram account claiming to be ShinyHunters took responsibility, though attribution remains unconfirmed.Wed, 17 Jun 2026 09:00:00 GMThttps://reliaquest.com/blog/threat-spotlight-shinyhunters-fast-tracks-saas-access-subdomain-impersonationcst-2202ShinyHunters is shifting from lookalike domain registration to subdomain impersonation tactics, hiding target organization branding in subdomains of generic SSO-themed domains to evade traditional domain monitoring. The group combines this with mobile-optimized phishing lures, outsourced spam and voice operations, and reused stolen CRM/ERP data to accelerate compromise of SaaS environments through session theft and help-desk MFA resets.Thu, 26 Feb 2026 18:00:00 GMThttps://wiz.io/blog/wiz-goes-even-more-globalcst-1831Wiz, a cloud security company, raised an additional $250 million in funding during the first half of 2021, bringing its total funding to $350 million. The capital injection from investors including Sequoia and Salesforce enabled the company to expand its headcount from 25 to 120 employees during that period.Tue, 14 Sep 2021 16:59:28 GMThttps://wiz.io/blog/salesforce-ventures-blackstone-and-algae-join-team-wizcst-1838Wiz completed its Series B funding round with an additional $120 million investment from Salesforce Ventures and Blackstone, along with participation from Aglaé Ventures. The round was previously announced in March and has now closed with these additional backers joining the effort.Thu, 10 Jun 2021 12:37:52 GMT