Researchers say three “SalesBleed” flaws in Salesforce Agentforce could let attackers plant malicious instructions inside a Web-to-Lead form submission that later causes an Agentforce agent to leak CRM data or post phishing in Slack. The attack can stay hidden until an employee asks Agentforce to interact with the poisoned lead, at which point data can be exfiltrated “zero-click” using crafted URLs or image tags, or used to send trusted-looking Slack messages.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine a normal Salesforce lead turning into a Slack phish… without anyone clicking anything. SalesBleed hides malicious instructions inside a Web-to-Lead form. It just sits there until someone asks Agentforce to summarize the lead, then the poisoned text makes Agentforce leak CRM data or post phishing links into Slack. That poisoned lead can make Agentforce post in an internal Slack channel: a trusted-looking bot message with a login link. As soon as the link appears, Slack link previews quietly send CRM data out, before anyone even clicks. If a bot or Agentforce posts an unexpected login or verification link, stop and report it to security, don’t click it, even if it looks like it came from Salesforce.
Researchers found flaws in Salesforce Agentforce that let attackers plant “poisoned” lead data which the AI agent later processed and used to silently leak CRM data, without any employee click. A related Slack integration flaw could also let attackers send phishing messages that appear to come from…
UK, US, and Dutch agencies warned that Iranian state-linked actors used social messaging apps to build trust with dissidents, journalists, and activists before sending disguised files that install Windows malware. The attackers often impersonated someone the target already knows or “technical…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
Researchers reported a real developer-targeting campaign linked to DPRK actors where attackers pose as legitimate recruiters or Web3 companies and trick targets into running code or pulling poisoned dependencies. The operation has now expanded to include malicious Terraform providers hosted in the…
Two real, ongoing intrusion campaigns targeted organizations in Latin America, including a Mexican transportation organization and Brazil’s financial sector. In the Brazil campaign, attackers reportedly got in via a resume-themed phishing attachment, then attempted to download and run tunneling…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
