---
title: Hackers Exploit Salesforce Data Loader in Sophisticated Vishing Attack
description: Hackers exploit Salesforce Data Loader in vishing scheme, targeting users to steal and extort sensitive data. Learn how to protect your organization from these sophisticated attacks.
---

[blog](https://buzzmybiz.co/blog)

# [Hackers Exploit Salesforce Data Loader in Sophisticated Vishing Attack](https://buzzmybiz.co/blog/hackers-exploit-salesforce-data-loader-in-sophisticated-vishing-attack)

 Written by [Randy Cooper](https://buzzmybiz.co/blog/author/randy-cooper) | Jun 6, 2025 2:26:49 PM

A financially motivated threat actor, known as **UNC6040**, has been orchestrating a sophisticated vishing (voice phishing) and extortion campaign targeting Salesforce users [securityweek.com](https://www.securityweek.com/google-warns-of-vishing-extortion-campaign-targeting-salesforce-customers/?utm_source=chatgpt.com)[bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/google-hackers-target-salesforce-accounts-in-data-extortion-attacks/?utm_source=chatgpt.com). The attackers impersonate IT support staff and call English-speaking employees at organizations spanning sectors like education, hospitality, and retail. During these calls, victims are instructed to approve a malicious version of Salesforce’s Data Loader connected app—granting attackers the ability to access and transfer sensitive data from their Salesforce environments [securityweek.com](https://www.securityweek.com/google-warns-of-vishing-extortion-campaign-targeting-salesforce-customers/?utm_source=chatgpt.com)[darkreading.com](https://www.darkreading.com/application-security/vishing-crew-salesforce-data?utm_source=chatgpt.com).

After establishing this unauthorized access, UNC6040 doesn’t stop at data theft; they often **wait for months** before initiating extortion efforts, claiming affiliation with the notorious ShinyHunters hacking group to bolster their threats [securityweek.com](https://www.securityweek.com/google-warns-of-vishing-extortion-campaign-targeting-salesforce-customers/?utm_source=chatgpt.com) [darkreading.com](https://www.darkreading.com/application-security/vishing-crew-salesforce-data?utm_source=chatgpt.com). The campaign also includes lateral movement—using the compromised Salesforce app to breach additional environments like Microsoft 365, Okta, and internal networks [securityweek.com](https://www.securityweek.com/google-warns-of-vishing-extortion-campaign-targeting-salesforce-customers/?utm_source=chatgpt.com)[darkreading.com](https://www.darkreading.com/application-security/vishing-crew-salesforce-data?utm_source=chatgpt.com). Google’s Threat Intelligence Group has flagged this as a primarily social-engineering-driven attack, rather than exploiting software vulnerabilities [securityweek.com](https://www.securityweek.com/google-warns-of-vishing-extortion-campaign-targeting-salesforce-customers/?utm_source=chatgpt.com)[darkreading.com](https://www.darkreading.com/application-security/vishing-crew-salesforce-data?utm_source=chatgpt.com).

Salesforce has previously warned about such threats and emphasizes the importance of customer responsibility in securing their accounts [salesforce.com](https://www.salesforce.com/blog/protect-against-social-engineering/?utm_source=chatgpt.com)[darkreading.com](https://www.darkreading.com/application-security/vishing-crew-salesforce-data?utm_source=chatgpt.com). To combat vishing, they recommend implementing multi-factor authentication (MFA), applying stricter verification protocols for connected apps, and training employees to be wary of unsolicited IT calls. Experts caution that while Data Loader is a legitimate administrative tool, threat actors can weaponize it if given the chance—underscoring the urgent need for governance and robust user awareness in SaaS environments [salesforce.com](https://www.salesforce.com/blog/protect-against-social-engineering/?utm_source=chatgpt.com)[darkreading.com](https://www.darkreading.com/application-security/vishing-crew-salesforce-data?utm_source=chatgpt.com).

SOURCE: [https://www.helpnetsecurity.com/2025/06/04/salesforce-vishing-attacks/](https://www.helpnetsecurity.com/2025/06/04/salesforce-vishing-attacks/)

[View full post](https://buzzmybiz.co/blog/hackers-exploit-salesforce-data-loader-in-sophisticated-vishing-attack)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Randy Cooper"
  },
  "dateModified" : "2025-07-19T14:26:06.052Z",
  "datePublished" : "2025-06-06T14:26:49Z",
  "headline" : "Hackers Exploit Salesforce Data Loader in Sophisticated Vishing Attack",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1024,
    "url" : "https://23329168.fs1.hubspotusercontent-na1.net/hubfs/23329168/AI-Generated%20Media/Images/salesforce%20cyber%20attack.jpeg",
    "width" : 1024
  },
  "mainEntityOfPage" : "https://buzzmybiz.co/blog/hackers-exploit-salesforce-data-loader-in-sophisticated-vishing-attack",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "blog"
  }
}
```