Google Exposes UNC6040's Vishing Raids on Salesforce Customers
Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce
CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins88% CONFIDENCEOverall confidence: 88%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or betterThe Google[1] Cloud Threat Intelligence post 'The Cost of a Call: From Voice Phishing to Data Extortion' is dated 'June 4, 2025'.
Google's threat researchers said a crew posing as IT support on the phone was talking employees into approving a fake Data Loader app, then bulk-stealing their companies' Salesforce data for extortion.