Salesforce Zero-Day Exploited to Phish Facebook Credentials

The cyberattacks used the legitimate Salesforce.com domain by chaining the vulnerability to an abuse of Facebook’s Web games platform, slipping past email protections.