Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)
Teaser from the source
UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).
This is the RSS-feed teaser. Read the full article at the original source.
Read at pwn.watchMore on ShinyHunters
Other news entries
- ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained FlawsNewsThe Hacker News
- In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS RansomwareNewsSecurityWeek
- Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion SiteNewsKrebs on Security
- ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and MoreNewsThe Hacker News
- Ransomware Response Expert Arrested in ShinyHunters FBI Hack ProbeNewsSecurityWeek
- Cyber exec arrested in case allegedly tied to ShinyHunters hackersNewsBleepingComputer
- FBI Arrests Executive at Ransomware Negotiation FirmNewsKrebs on Security
- FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal HackNewsThe Hacker News
Source: https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025
ID