Security Report · raw.githubusercontent.com

WithSecure Report Highlights URL Threats and Identity Abuse in Salesforce Environments

Oct 20, 2026 · Original Report (PDF) ↗

Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.

Summary

WithSecure’s Salesforce threat report finds URL-based threats dominated 2025 detections, while attackers abused identities, OAuth tokens, and integrations. It also examines risks from autonomous agents and recommends stronger access and content controls.

Key points

WithSecure reports Q4 malicious detection activity was approximately eight times the Q1 level; broader coverage and new detection mechanisms may partly explain the increase.
URLs accounted for 98.26% of malicious detections. Approximately 98.9% of malicious file detections involved embedded malicious URLs, making documents primarily delivery containers rather than malware payloads.
Observed QR-code phishing campaigns used Tycoon 2FA infrastructure to proxy authentication and capture session cookies, potentially enabling access despite completed MFA.
Publicly reported incidents involved legitimate access paths rather than Salesforce platform vulnerabilities, including UNC6040’s social engineering of users into authorizing attacker-controlled connected applications.
The report describes stolen integration OAuth tokens enabling unauthorized customer-data access through Salesloft Drift and Gainsight, illustrating how vendor compromise can propagate across customer environments.
Agent-based execution and automation can amplify excessive permissions and malicious inputs. Noma Labs’ ForcedLeak demonstration showed crafted Web-to-Lead content influencing an agent into unintended information disclosure.
Recommendations include least-privilege access, limited OAuth token lifetimes, integration reviews, monitoring unusual exports and API activity, inspecting incoming content, and maintaining procedures to revoke access and disable integrations.

Article Details

Publisher: WithSecure
Report Period: 2025
Scope: Global Salesforce threat activity based on WithSecure Cloud Protection for Salesforce telemetry and publicly disclosed incidents, including disclosures in January 2026.
Key Statistics: Malicious detection activity across all scans was approximately eight times higher in Q4 2025 than in Q1; the report cautions that expanded detection coverage and new detection mechanisms may partly explain the increase.
URLs accounted for 98.26% of malicious detections in 2025, compared with 1.74% for files.
Approximately 98.9% of malicious file detections involved embedded malicious URLs within otherwise legitimate-looking documents.
The United States, United Kingdom, and Australia together accounted for approximately 53.5% of organizations with malicious detections in 2025.
The United States accounted for 58% of organizations affected by the observed AitM quishing campaigns.
Recommendations: Maintain an inventory of users, service accounts, connected applications, agents, automation workflows, and associated data flows, with clear security ownership.
Review third-party integrations for necessity and scope, minimize their permissions, and periodically reassess vendor trust and exposure.
Enforce strong authentication, limit OAuth token lifetimes, review delegated permissions, and validate Salesforce behavior when upstream MFA signals are missing or unverifiable.
Monitor unusual exports, unexpected API activity, indirect authentication flows, and changes to connected applications; inspect files, URLs, and externally supplied content before downstream consumption.
Define enforceable boundaries for automated agents and maintain incident response procedures that support rapid access revocation, integration disabling, and containment.