The AWS Systems Manager Agent and Remote Access Trojan

Salesforce is usually considered a trusted company. And that's exactly the problem here by impersonating the Salesforce brand. It makes these phishing emails so much more plausible. The problem has been fixed by Salesforce now. Having a write up from Gaudio here regarding all the details involved in actually identifying this vulnerability.