Threat actor “UNC6040” is impersonating IT support personnel at organizations via vishing (voice phishing) attacks to trick employees into granting them access to sensitive credentials, ultimately facilitating the theft of an organization’s Salesforce data.
Google has put out a warning about this which you can read here: https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion
James McQuiggan, security awareness advocate at KnowBe4, commented:
“You wouldn’t blindly open your front door to a stranger, so we must consider whether you should pick up the phone and trust the voice on the other end.
Ask yourself: Were you expecting this call?
“Think about it. If someone knocked at your door and you weren’t expecting anyone, would you swing it open? Probably not. Most of us would peek through the window, check the camera, or at least ask, “Who is it?” The phone shouldn’t be any different. If you weren’t expecting a call from your IT support team, cloud service provider, or a software vendor, don’t assume the call is real. Cybercriminals are banking on that assumption. They’re hoping you’ll pick up the phone and follow instructions without pausing to think. If you do pick up, always verify. Sometimes, we do answer the door. The same goes for the phone. But once the conversation starts, stay skeptical. If the caller says they’re from a tech company and need access to your system, pause. Ask for their name, case number, and callback number. Then, hang up. Go to the company’s official support page or contact your tech team using another communication method. Contact them directly. See if there’s a case with your name on it. Assuredly, there isn’t.
Remember: legitimate tech companies don’t call you to fix an issue with your computer or application. That’s not how it works.
“There’s often a moment of hesitation. You don’t want to seem rude. You think, “What if this is real?” But being polite shouldn’t cost you your security when it comes to your data and username or password. Hanging up isn’t rude. It’s responsible.
Treat unexpected phone calls like you treat an unexpected knock at your door. Stop. Look. Verify. And if something feels off, it probably is. Stay cautious. Stay curious. And remember, security starts with a simple question: “Do I know who’s calling?”
Any organization that uses Salesforce should heed Google’s warnings and take action to educate their users so that they are not victims of this campaign. And I think it’s safe to say that we’ll be seeing more of this type of campaign going forward as threat actors wouldn’t do this if it were not effective.
Google Issues A Warning About A Threat Actor Going After Salesforce Data
Posted in Commentary with tags Google, Salesforce on June 4, 2025 by itnerdThreat actor “UNC6040” is impersonating IT support personnel at organizations via vishing (voice phishing) attacks to trick employees into granting them access to sensitive credentials, ultimately facilitating the theft of an organization’s Salesforce data.
Google has put out a warning about this which you can read here: https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion
James McQuiggan, security awareness advocate at KnowBe4, commented:
“You wouldn’t blindly open your front door to a stranger, so we must consider whether you should pick up the phone and trust the voice on the other end.
Ask yourself: Were you expecting this call?
“Think about it. If someone knocked at your door and you weren’t expecting anyone, would you swing it open? Probably not. Most of us would peek through the window, check the camera, or at least ask, “Who is it?” The phone shouldn’t be any different. If you weren’t expecting a call from your IT support team, cloud service provider, or a software vendor, don’t assume the call is real. Cybercriminals are banking on that assumption. They’re hoping you’ll pick up the phone and follow instructions without pausing to think. If you do pick up, always verify. Sometimes, we do answer the door. The same goes for the phone. But once the conversation starts, stay skeptical. If the caller says they’re from a tech company and need access to your system, pause. Ask for their name, case number, and callback number. Then, hang up. Go to the company’s official support page or contact your tech team using another communication method. Contact them directly. See if there’s a case with your name on it. Assuredly, there isn’t.
Remember: legitimate tech companies don’t call you to fix an issue with your computer or application. That’s not how it works.
“There’s often a moment of hesitation. You don’t want to seem rude. You think, “What if this is real?” But being polite shouldn’t cost you your security when it comes to your data and username or password. Hanging up isn’t rude. It’s responsible.
Treat unexpected phone calls like you treat an unexpected knock at your door. Stop. Look. Verify. And if something feels off, it probably is. Stay cautious. Stay curious. And remember, security starts with a simple question: “Do I know who’s calling?”
Any organization that uses Salesforce should heed Google’s warnings and take action to educate their users so that they are not victims of this campaign. And I think it’s safe to say that we’ll be seeing more of this type of campaign going forward as threat actors wouldn’t do this if it were not effective.
Leave a comment »