Hackers Exploit Salesforce Data Loader in Sophisticated Vishing Attack

A financially motivated threat actor, known as UNC6040, has been orchestrating a sophisticated vishing (voice phishing) and extortion campaign targeting Salesforce users securityweek.com bleepingcomputer.com. The attackers impersonate IT support staff and call English-speaking employees at organizations spanning sectors like education, hospitality, and retail. During these calls, victims are instructed to approve a malicious version of Salesforce’s Data Loader connected app—granting attackers the ability to access and transfer sensitive data from their Salesforce environments.

Buzz My Biz provides a unified cybersecurity platform ideal for business, education, healthcare, and local governments. Give us a call at [phone] or schedule a meeting today .