Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters) ยท updates https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025 UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240). en Fri, 01 Aug 2025 00:00:00 GMT Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters): Google confirms the breach exposed prospective Google Ads customers' contact info https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025 https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025#2025-08-3643857a Fri, 01 Aug 2025 00:00:00 GMT high <p><a href="https://www.bleepingcomputer.com/news/security/google-confirms-data-breach-exposed-potential-google-ads-customers-info/">Source</a></p> Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters): Google Threat Intelligence describes UNC6040's vishing and Data Loader abuse https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025 https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025#2025-06-04-4a52dbcc Wed, 04 Jun 2025 00:00:00 GMT high <p><a href="https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion">Source</a></p> Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters): Google's corporate Salesforce instance breached by UNC6040 https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025 https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025#2025-06-f29cfa4c Sun, 01 Jun 2025 00:00:00 GMT high <p><a href="https://www.bleepingcomputer.com/news/security/google-suffers-data-breach-in-ongoing-salesforce-data-theft-attacks/">Source</a></p>