The cyberattacks used the legitimate Salesforce.com domain by chaining the vulnerability to an abuse of Facebook’s Web games platform, slipping past email protections.
Source: htdarkreading.com