Story perspectives

UNC6040 Vishing Attacks Target Salesforce Users, 20 Firms Affected

6/5/2025

49 8

Summary

Story summary

Google Threat Intelligence Group (GTIG) monitors UNC6040, a threat group focused on voice phishing (vishing) targeting Salesforce users.
The group masquerades as IT support, deceiving employees into installing a compromised Data Loader app for data theft.
Approximately 20 organizations in the Americas and Europe have been impacted by these attacks.
UNC6040 may partner with other threat actors for extortion, often months post-breach.
Salesforce has provided warnings and guidance to assist customers in safeguarding against these tactics.

1 of 1

Story summary

Google Threat Intelligence Group (GTIG) monitors UNC6040, a threat group focused on voice phishing (vishing) targeting Salesforce users.
The group masquerades as IT support, deceiving employees into installing a compromised Data Loader app for data theft.
Approximately 20 organizations in the Americas and Europe have been impacted by these attacks.
UNC6040 may partner with other threat actors for extortion, often months post-breach.
Salesforce has provided warnings and guidance to assist customers in safeguarding against these tactics.