Salesforce Defies Extortionists After Customer Data Heist; Cl0p Exploits Critical Oracle Zero-Day

Salesforce has officially refused the ransom demand from 'Scattered LAPSUS$ Hunters'. New technical details reveal the attackers employed two primary methods: tricking employees via vishing into authorizing a malicious Salesforce Data Loader application, and abusing compromised OAuth tokens from the third-party Salesloft Drift integration. Salesforce has disabled the problematic Drift integration, and Salesloft has advised customers to refresh access tokens. The group continues to list over 40 high-profile victims, including Adidas and Disney/Hulu, with an October 10 deadline for data release.

Further details on CVE-2025-27915 indicate an additional exploitation vector. While previously reported as a stored XSS via malicious iCalendar requiring only viewing, new information suggests attackers can also exploit the flaw by tricking users into clicking a specially crafted link. This interaction allows malicious scripts to execute in the user's authenticated Zimbra session, leading to session hijacking and data theft. Federal agencies are still mandated to remediate the flaw, and all organizations are urged to prioritize patching.

New information confirms that Oracle E-Business Suite versions 12.2.3 through 12.2.14 are specifically affected by CVE-2025-61882. The public availability of exploit code on platforms like Telegram increases the likelihood that other threat actors, such as Scattered Spider and ShinyHunters, will adopt this TTP. Additionally, the update highlights the potential for ransomware deployment as a direct consequence of successful exploitation, leading to widespread operational disruption. New detection observables include monitoring for `cmd.exe`, `powershell.exe`, or `sh` processes spawned by Oracle services, providing more specific guidance for security teams.