UNC6040 voice phishing campaign against Salesforce customers
Google Threat Intelligence reported on June 4, 2025 that UNC6040 was calling employees while posing as IT support and talking them into authorizing a modified Salesforce Data Loader connected app, which the actor then used to export Salesforce data for extortion. An Okta-branded phishing panel collected credentials and MFA codes during some calls. On August 5, 2025 Google added that one of its own corporate Salesforce instances had been hit by similar UNC6040 activity in June.
- Victim
- Multiple: Salesforce customer organizations, including Google (confirmed August 5, 2025)
- Industry
- Cross-industry
- Country
- Global
- Intrusion began
- Not disclosed
- First disclosed
- Jun 4, 2025
- Actor
- UNC6040, with extortion by UNC6240, which claims the ShinyHunters name (Google Threat Intelligence) (Extortion group)
- Initial access
- Consent phishing
- Identity control that failed
- Authorization
- MFA
- Present and bypassed
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A phone call converted into a trusted OAuth connection that no password reset would revoke. Restricting which connected apps users can authorize, requiring admin approval for API-enabled apps, and phishing-resistant MFA close the path.
Go deeper on SWI
- Technique: OAuth consent phishing
Sources
- The Cost of a Call: From Voice Phishing to Data Extortion, Google Threat Intelligence Group, Jun 4, 2025
- Google Exposes Vishing Group UNC6040 Targeting Salesforce with Fake Data Loader App, The Hacker News, Jun 5, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Cyberhaven Chrome extension hijacked through OAuth consent phishing 2024 · Consent phishing
- Midnight Blizzard password spray into Microsoft corporate email 2024 · Password spraying
- Stolen Microsoft 365 session tokens replayed into 79 organizations 2026 · Phishing (adversary-in-the-middle)
- Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). UNC6040 voice phishing campaign against Salesforce customers. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-unc6040-salesforce-vishing-campaign/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.