Salesforce Phishing: The URLs Native Scanning Never Blocks

It is the final week of the annual IT audit, and the security team is reviewing their checklist with relief because all endpoints are protected by CrowdStrike on laptops and Trend Micro on servers. Salesforce malware scanning is on by default, so they assume the org is safe from virus and URL threats by extension.

Six months later, a file uploaded through a customer portal sits in Salesforce Files, bypassing endpoint defenses entirely. By the time the team notices, it may already have spread across internal teams and reached external stakeholders.

Cloud platforms operate under fundamentally different security assumptions than traditional endpoints. Antivirus software protects devices, while Salesforce security threats reside inside the files, documents, and links shared within the platform itself. Salesforce malware scanning addresses part of that surface, and endpoint antivirus addresses none of it.

Why Desktop Antivirus Doesn’t Protect Salesforce

Desktop antivirus operates within the operating system of a managed device, monitoring file system activity, registry modifications, process execution, and local network calls. Detection occurs only when a file interacts with the endpoint, for example when it is downloaded, opened, or executed. Salesforce files live entirely in cloud storage and do not touch the endpoint until a user actively downloads them. By the time desktop antivirus detects the threat, the file may already have been accessed by multiple users, shared across teams, or triggered automated workflows such as approvals, notifications, and integration processes.

The 2025 attacks proved the point. Threat actors used stolen OAuth and refresh tokens from trusted third-party integrations, including the Salesloft Drift app, to access customer Salesforce environments and export data without ever touching a corporate endpoint. Compromised tokens tied to Gainsight published apps extended the same pattern later that year. Verizon’s 2026 Data Breach Investigations Report found that supply chain breaches increased 60 percent, and third parties now feature in 48 percent of breaches.

Common Salesforce Threat Entry Points

Malicious content rarely enters Salesforce through obvious threats. Most exposure happens through normal business workflows designed for speed and accessibility.

Files can enter via Experience Cloud portals when external users upload documents that bypass network controls, through Email-to-Case attachments converted automatically into Salesforce Files, or via API integrations from ERP, document management, and marketing systems where authentication is enforced but content validation may be missing. Compromised or misconfigured connected apps and OAuth integrations can insert files directly, while collaboration features like Chatter quickly redistribute them, amplifying exposure before controls respond. These entry points are operational necessities, highlighting the need for inspection at the Salesforce layer.

Salesforce and the Shared Responsibility Model

Salesforce secures the underlying infrastructure: physical data centers, network perimeter, and platform runtime. Responsibility shifts at the application layer, where customers remain accountable for how the platform is configured and used, including validating file content, securing integrations, enforcing access control policies, and monitoring activity within the org.

File and URL scanning sit clearly within the customer’s responsibility boundary. Without inspection controls implemented inside the platform, malicious content can enter and circulate while the infrastructure itself remains secure.

Salesforce Malware Scanning: What Summer ’26 Covers and What It Leaves Open

Salesforce malware scanning became generally available for Salesforce Files in the Summer ’26 release, and the setting is on by default under Setup, Salesforce Files, Malware Scanning. This is a genuine improvement over having nothing at the platform layer, and every Salesforce team should leave it enabled. It helps prevent users from unknowingly uploading a threat. It was never built to stop attackers who deliberately target Salesforce customers, and Salesforce documents the boundaries plainly.

Salesforce Help states that Salesforce malware scanning flags files only when they have a high probability of being malicious, and it directs organizations that require more stringent scanning to use one of Salesforce’s malware scanning partners. That is the platform vendor telling its own customers, in writing, that native scanning is a floor and not a ceiling.

The documented behavior explains why. A file uploaded through the API is allowed into the org and scanned afterward, so it lands before any verdict exists. A file that predates the feature is not scanned until someone tries to download it, and Salesforce allows that first download to complete while the scan runs, blocking only later attempts. Files larger than 100 MB are not scanned at all, and Salesforce blocks neither their upload, preview, nor download, even though Salesforce Files accepts uploads as large as 10 GB. Salesforce does not disclose the detection method behind the scanner, so administrators cannot test what it catches.

None of this is hidden. The native scanner is free and identical in every Salesforce org, and its limits are published, which means an attacker can run the same scanner you run, confirm a file slips through, and only then aim it at you. A file built to clear those limits clears them everywhere.

Native scanning is a checkbox that flags the files most likely to be malicious. EzProtect is built on the opposite assumption, and no file moves until scanning proves it safe, whether it arrives through the interface or the API, which takes seconds. Detection layers signature scanning, behavioral analysis, and true file type detection, and every layer is testable rather than undisclosed. True file type detection reads actual file content, so an executable renamed to .png gets caught instead of waved through by extension and MIME checks that attackers alter freely. Zero-day and unknown threats run through behavioral analysis in an isolated sandbox. Malicious URLs and links, which native scanning does not inspect at all, are scanned across fields and objects against live threat intelligence. EzProtect covers every file up to 2 GB, powered by Sophos and Bitdefender across more than eleven years of securing Salesforce.

The Single-Layer Signature Problem

Many organizations that deploy Salesforce scanning still rely primarily on signature-based detection. Signature engines compare file hashes or binary patterns against databases of known malicious samples, flagging or blocking any match. The approach is computationally efficient and highly effective against established malware families.

The limitation appears when the threat is new or modified. Signature-based detection fails in several common scenarios:

Zero-day threats: previously unseen malware with no existing signature.

Polymorphic malware: malicious code that alters its structure slightly to generate a new hash while preserving functionality.

Targeted payloads: customized files crafted specifically for a single organization.

Even minor changes to a file’s structure produce a completely different hash value, so the file appears entirely new even though its behavior remains malicious. Signature scanning checks identities against a watch list at the door, which protects you only when the individual is already known. Files and links reach Salesforce through trusted workflows and spread internally before any signature database updates. Signature-based detection remains valuable. It should not be the only layer.

Operational Impact Beyond Malware

File-based content in Salesforce creates operational risk beyond security incidents. Malicious files can trigger automated flows, distribute unsafe downloads to external users, or enable data exfiltration without visibility. In regulated industries, this increases compliance and legal exposure, and immediate scanning reduces both financial and regulatory risk. When a threat does land, the first 24 hours determine the outcome.

The Multi-Layer Framework

Salesforce malware scanning is one layer. Comprehensive protection requires a multi-layer approach because no single method can catch all threats. Each layer complements the others, reducing blind spots in Salesforce file and URL security.

Layer 1: Signature Scanning

Signature scanning forms the foundation of threat detection by matching files against known threat databases. It is fast and uses minimal computational resources, making it effective at catching the bulk of commodity malware. Despite its speed and efficiency, this layer alone is insufficient because unknown or modified threats can bypass signature checks entirely.

Layer 2: Behavioral and Heuristic Analysis

Behavioral or heuristic analysis examines what a file does rather than what it appears to be. This layer identifies suspicious patterns, such as PDFs containing embedded JavaScript or Word documents attempting to execute macros that reach external URLs. Running that analysis in an isolated sandbox detects threats that evade signature-based scanning.

Layer 3: AI and Machine Learning Detection

AI and machine learning models are trained on millions of malicious and harmless samples to recognize patterns beyond known signatures. This allows detection of threats that are structurally similar to previous attacks but do not match any existing hash, making it critical for zero-day threats and highly targeted attacks.

Layer 4: True File Type Analysis

True file type analysis examines the actual structure and headers of a file rather than relying on extensions. This prevents attackers from bypassing scanners by renaming executables as images or documents, as demonstrated in our latest test of the Salesforce native scanner. It ensures that the content is evaluated accurately, reducing the risk of extension-based spoofing.

Layer 5: URL and Link Scanning

Files are not the only vector for compromise. Malicious URLs embedded in records, Chatter posts, or case comments bypass file-focused scanners entirely. URL and link scanning examines these embedded links to detect threats before they can be accessed or shared, closing one of the largest gaps in cloud security. Salesforce native scanning does not inspect URLs or links at all, so this gap remains entirely the customer’s to close.

The Zero-Trust Scanning Model

Zero-trust scanning represents a fundamental shift in how enterprises secure Salesforce files and ensures that every Salesforce security scan blocks unsafe files before they interact with workflows. Unlike traditional models, where files may reside undetected until routine scans, zero-trust ensures that every file is blocked until verified at upload, preventing automation such as Flows or Apex from interacting with unverified content. Without this approach, malicious files can trigger workflows, distribute sensitive data, or escalate privileges, extending dwell time and increasing operational and compliance risk. The distinction is whether a file is held until it is proven safe or admitted while a scan catches up behind it.

For regulated industries, dwell time also affects compliance exposure. Frameworks aligned with guidance from the National Institute of Standards and Technology and programs such as FedRAMP emphasize early detection and containment, making zero-trust both a technical and regulatory control in malware detection for Salesforce platforms.

What to Ask When Evaluating Salesforce Security Tools

IT teams can use the following framework to evaluate file and URL security solutions for Salesforce. Many organizations begin by searching for a “Salesforce antivirus”, but file security in Salesforce requires more than traditional antivirus alone.

Effective protection should include the following capabilities, and this is how EzProtect delivers them:

• Scan timing: Files must be inspected the moment they enter Salesforce. EzProtect scans in real time during upload and blocks access until the file is verified, preventing Flows, Apex automation, or user downloads from interacting with unscanned content. Ask specifically what happens on API upload and what happens to files that predate the tool, because those are the two paths where a scanner lets a file land first and rules on it later.
• Detection layers: Multiple layers are essential. EzProtect applies signature scanning, behavioral analysis, AI detection, true file type analysis, and URL/link scanning to cover zero-day and targeted threats.
• URL and link coverage: Threats frequently rely on malicious links inside otherwise clean documents. EzProtect scans embedded URLs and flags unsafe destinations, addressing risks that file-only scanning would miss.
• Object coverage: Files can enter through Experience Cloud, Email-to-Case, APIs, integrations, Chatter, and automation workflows. EzProtect applies scanning consistently across all Salesforce clouds to prevent internal redistribution of malicious content.
• Performance: Protection must not slow down the platform. EzProtect is designed to scan quickly while maintaining user experience and workflow continuity.
• Data access and location: Scanning occurs with strict access controls, respecting data residency and regulatory requirements.
• The Cost of Assumption

The audit team from the opening scenario illustrates a common enterprise blind spot: assuming Salesforce is secure because endpoints are protected and the platform now scans. Files that enter undetected spread quickly through automated workflows, shared records, and integrations, and by the time anyone notices, they may already have triggered processes or distributed sensitive data.

The scale of the problem is growing. Verizon’s 2026 Data Breach Investigations Report analyzed more than 22,000 confirmed breaches, nearly double the 12,195 confirmed the previous year, and found ransomware present in 48 percent of them, up from 44 percent.

Salesforce malware scanning is a floor, not a ceiling. Flagging the obvious threat is not the same as protecting your company’s most valuable asset, your data. You can model what an attack would cost your org before you find out the hard way. Salesforce recommends a partner solution for more stringent enterprise-ready scanning, and EzProtect is an enterprise-ready option for industries where compliance and trust are fundamental.

Book a 30-minute demo and see exactly how the Salesforce scanner holds up against EzProtect for your org.

 

---

Frequently Asked Questions

Does Salesforce scan files for viruses?

Yes, partly. Salesforce malware scanning became generally available for Salesforce Files in the Summer ’26 release and is on by default. Salesforce Help states it flags files only when they have a high probability of being malicious, and it recommends a partner solution for more stringent scanning.

Is Salesforce malware scanning on by default?

Yes. The setting to scan files for viruses or malware is on by default under Setup, Salesforce Files, Malware Scanning. Administrators can enable notifications for users holding the Manage Malicious Files permission. Salesforce Help lists the feature as available in Group, Professional, Enterprise, Performance, Unlimited, and Developer editions.

What size files does Salesforce malware scanning cover?

Files are scanned only when they are 100 MB or smaller. Above that threshold, Salesforce does not scan the file and does not block users from uploading, previewing, or downloading it. Salesforce Files accepts uploads as large as 10 GB, which leaves a wide unscanned range.

Does Salesforce malware scanning check URLs and links?

No. Salesforce documents the feature for Salesforce Files only, and that documentation does not describe inspection of URLs or links embedded in records, Chatter posts, or case comments. Closing that gap requires a third-party scanner that inspects links against live threat intelligence.

Does Salesforce scan files uploaded through the API?

Not before they land. Salesforce allows the API upload to complete and scans the file asynchronously afterward. If the file is malicious, it appears in the Malicious Files list after the fact. Interface uploads are blocked during upload, but API uploads enter the org first.

What happens to files uploaded before malware scanning was enabled?

They are not scanned until someone tries to download them. Salesforce allows that first download to proceed while it scans the file asynchronously, then blocks future download attempts if the file proves malicious. The first download is not prevented.

Does Salesforce recommend a third-party malware scanner?

Yes. Salesforce Help states that malware scanning flags files only if they have a high probability of being malicious, and that organizations requiring more stringent scanning should consider using one of Salesforce’s malware scanning partners.

Do I still need a third-party Salesforce antivirus?

If your org accepts files from customers, partners, or API integrations, yes. Native scanning covers a subset of upload paths, does not disclose its detection method, stops at 100 MB, and does not inspect URLs. Multi-layer scanning closes those gaps.