What Salesforce Organizations Need to Know About the Growing Vishing Threat from UNC6040 

Google’s Threat Intelligence Group (GTIG) has disclosed a financially motivated threat cluster, UNC6040, that specializes in voice phishing (vishing) campaigns designed to breach organizations’ Salesforce environments for large-scale data theft and eventual extortion. 

This is especially critical for Salesforce organizations because attackers like UNC6040 specifically target platforms storing vast amounts of sensitive customer and operational data. As a central hub for client information, sales pipelines, and business operations, Salesforce is both a valuable resource and an attractive target. A successful breach could result not only in data loss, but in regulatory consequences, reputational damage, and financial extortion. Understanding and defending against vishing threats is critical to safeguard the integrity of Salesforce environments and maintain trust with clients, partners, and stakeholders. 

Who is UNC6040? 

UNC6040 is a threat group exhibiting similar behaviors like Scattered Spider and other threat actors linked to the cybercrime collective known as The Com. According to GTIG, the group has repeatedly succeeded in breaching networks by impersonating IT support personnel in convincing phone-based social engineering attacks. 

These vishing calls are designed to trick English-speaking employees into performing actions that grant access or reveal sensitive information such as credentials, which are then used to infiltrate enterprise systems and exfiltrate data. 

How the attack works 

UNC6040’s attacks typically begin with a phone call from someone posing as IT support. UNC6040 operators use a combination of live calls and automated phone systems with pre-recorded messages and interactive menus. These systems help them gather reconnaissance, such as internal application names, support team contacts, and company-wide technical issues, before engaging targets directly. 

Once on the call, the attacker instructs the victim to install a modified version of Salesforce’s Data Loader — a legitimate tool used to import, export, and update Salesforce data in bulk. The malicious version is often disguised under a different name like, “My Ticket Portal.” 

Victims are guided to Salesforce’s connected app setup page and asked to authorize the malicious app. This grants the attacker access to the organization’s Salesforce environment, enabling them to exfiltrate large volumes of customer and operational data. 

From there, UNC6040 moves laterally across the network, targeting other platforms such as Okta, Workplace, and Microsoft 365. The group harvests credentials and sensitive data from these systems, often without triggering security policies and alerts. 

In some cases, extortion attempts occur months after the initial breach. During these campaigns, UNC6040 has claimed affiliation with the ShinyHunters group — likely to increase pressure on victims and accelerate ransom payments. 

Why this matters 

Google reports that approximately 20 organizations have been affected by this campaign. These include entities across hospitality, retail, education, and other sectors in North and South America and Europe. The attacks are described as “opportunistic,” meaning the group casts a wide net and exploits any vulnerable entry point it finds. 

UNC6040’s tactics overlap with those of other groups in The Com, particularly in their targeting of Okta credentials and use of IT support impersonation. However, their focus on Salesforce data theft sets them apart from groups like Scattered Spider, which typically aim for broader network access. 

Mandiant, a Google-owned threat intelligence firm, emphasized that vishing campaigns like UNC6040’s are built on extensive reconnaissance. The normalization of remote IT support and outsourced service desks has made employees more susceptible to engaging with unfamiliar personnel — creating fertile ground for social engineering. 

How to defend against vishing 

When it comes to proteting your data from threat actors like UNC3944 (aka Scattered Spider), organizations should consider the following proactive defenses:  

1. Educate employees about social engineering tactics. Make it clear that IT will never ask them to install or authorize apps over the phone. 
2. Implement strict app authorization policies in platforms like Salesforce and Microsoft 365. 
3. Monitor connected apps and audit for unusual authorizations or access patterns. 
4. Use behavioral analytics to detect lateral movement and data exfiltration. 
5. Adopt a Zero Trust model — never trust, always verify. 
6. Harden identity infrastructure by enforcing phishing-resistant MFA, restricting self-service password resets, and monitoring for suspicious identity activity. 
7. Limit access to administrative tools and enforce just-in-time access provisioning. 
8. Simulate vishing attacks as part of regular security awareness training to test and reinforce employee vigilance. 

Salesforce acknowledged UNC6040’s campaign in March 2025, warning that attackers were impersonating IT support to trick employees into giving away credentials or approving malicious connected apps. The company emphasized that these incidents did not involve or originate from any vulnerabilities in its platform. 

“All the observed incidents relied on manipulating end users,” Salesforce said. “Attacks like voice phishing are targeted social engineering scams designed to exploit gaps in individual users’ cybersecurity awareness and best practices.” 

Salesforce has published guidance to help customers protect their environments from social engineering, including best practices for app authorization and user training. 

• Audit and restrict connected app permissions in Salesforce. 
• Enforce least privilege access across all systems.
• Apply IP-based login controls.
• Configure and deploy Salesforce Shield and other monitoring tools for early detection.

Final thoughts 

UNC6040’s campaign is a stark reminder that even the most secure platforms can be compromised through human error. The group’s use of vishing, legitimate tools, and delayed extortion tactics demonstrates that attacker’s aren’t breaking in, they are logging in. 

Organizations must combine technical controls with user education to defend against evolving threats. As GTIG noted, the extended time frame between initial compromise and extortion means that more victims may still be at risk in the weeks and months ahead. 

If you believe your organization has been impacted by UNC6040, contact our team immediately.