https://pwn.watch/t/vishing Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Sun, 31 Aug 2025 00:00:00 GMT https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025 https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025 Sun, 31 Aug 2025 00:00:00 GMT high <p>UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2025-08: Google confirms the breach exposed prospective Google Ads customers' contact info (<a href="https://www.bleepingcomputer.com/news/security/google-confirms-data-breach-exposed-potential-google-ads-customers-info/">source</a>)</li><li>2025-06-04: Google Threat Intelligence describes UNC6040's vishing and Data Loader abuse (<a href="https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion">source</a>)</li><li>2025-06: Google's corporate Salesforce instance breached by UNC6040 (<a href="https://www.bleepingcomputer.com/news/security/google-suffers-data-breach-in-ongoing-salesforce-data-theft-attacks/">source</a>)</li></ul>