Salesforce Threat Intelligence says multiple threat actors used ARTEX to try to reach Salesforce environments, which is why is there a cyber attack happening right now is the right question for customers. The activity ran through stolen credentials and trusted integration sessions. Salesforce says the pattern did not come from a vulnerability in its platform.
ARTEX and Salesforce access
ARTEX is an AI-enabled offensive framework that Salesforce describes as open source and multi-agent. It was originally built to simplify autonomous penetration testing of systems and networks. Its original GitHub repository was taken down by its creator, but community forks still circulate.
That makes the tool easier to pick up than a single actor-controlled utility. Salesforce assesses it as an accessible capability for numerous threat actors rather than something tied to one group or one nation state. Google Threat Intelligence has said in-the-wild use of these frameworks is a critical inflection point for defenders.
Salesforce Threat Intelligence
Salesforce Threat Intelligence says audit logs show the campaign cluster rapidly and dynamically writing automation to interact with the environment. The firm also says the operational scale and execution velocity exceeded standard human operator capabilities. In practice, that points to machine-assisted activity that can move faster than a manual intruder and can be harder to spot as a single, slow intrusion.
The activity also included the automated deployment of custom Apex code immediately after initial access. Apex is Salesforce's programming language for platform logic, so code dropped at that stage can be used to manipulate workflows and connected systems inside a customer environment.
Salesforce customers targeted
The target set was Salesforce customer environments reached through compromised application credentials and trusted integration sessions. Salesforce says it directly notified affected customers after observing the stolen-credential-driven campaign. The same analysis incorporated vendor intelligence from Google Threat Intelligence Group, CrowdStrike, and Microsoft.
The sharpest complication is that the campaign hit customer environments without stemming from a platform flaw. For defenders, that shifts attention away from patching Salesforce itself and toward credential hygiene, integration review, and tighter control over any trusted session that can be abused to write automation or run Apex.
Which customers were affected and what specific defensive steps Salesforce recommends are not detailed in the source. That leaves the practical next step at the customer level: review application credentials, trusted integrations, and any unexpected Apex activity before the same access path is reused.
