Stop Salesforce Phishing Attacks

A sophisticated hacking group known as UNC6040 targeted Salesforce customers in a highly coordinated phishing campaign—specifically vishing (voice phishing). Learn more here.

1. New Application Monitor

Any new connected app that suddenly appears, or an existing app requesting expanded scopes, is detected and triggers an alert.  Arovy can also automatically block unapproved applications.

In this case, the malicious Data Loader would have been flagged the moment it tried to register as a connected app.

2. New User Monitor
Unexpected user authentications, especially OAuth logins from non-standard IP addresses, generate real-time alerts.

3. Event Monitoring
Since Arovy ingests Salesforce Shield events, it would spot irregular data-exfiltration patterns (e.g., hundreds of records being mass-exported by a Data Loader instance).

Correlating these anomalies with the connected-app alerts would provide a clear signal that an active data theft was underway.