Archive · 5 Jun 2025
Hackers Exploit Salesforce App to Steal Data, Extort Companies
Some bad guys are pretending to be from Salesforce and calling employees.
They trick employees into installing a fake version of a program called Data Loader.
This fake program lets the hackers steal information from the company and get into other services.
They can then ask the company for money.
Google says around 20 companies have been affected.
Salesforce says their platform isn't the issue, and it's because people are being tricked.
They warned people about these kinds of calls in a blog post.
Hackers are tricking employees into installing a modified Salesforce app.
The modified app allows hackers to steal data and access cloud services.
Hackers use voice calls to trick employees into installing the malicious app.
Roughly 20 organizations have been affected by the campaign.
Salesforce states the issue isn't due to platform vulnerabilities.
- Who
- Hackers tracked as UNC6040
- What
- Stole data and accessed cloud services by tricking employees into installing a modified Salesforce app.
- When
- Observed over the past several months
- Where
- Europe and the Americas
- Why
- To steal data, gain access to corporate services, and extort companies.
- Hacker Group
- UNC6040
- Hacker Actions
- Data theft, access to cloud services, extortion
- App Abused
- Salesforce Data Loader, a modified version
- Attack Method
- Voice calls (vishing)
- Approximate Affected
- 20 organizations
- Targeted Locations
- Europe, Americas