Google Sheds Light on ShinyHunters' Salesforce Tactics

Google is highlighting UNC6040’s social‑engineering tactics against Salesforce users, with Mandiant detailing how attackers use vishing to lure staff into compromising Salesforce environments. According to Mandiant, the threat actors target employees by presenting themselves as third‑party vendors or support personnel, then coax them into visiting a modified Salesforce Data Loader app to access and exfiltrate customer data, followed by extortion demands sometimes months later.

The group has claimed responsibility for some of these attacks, and researchers note that the intrusions also yield credentials for lateral movement across Okta and Microsoft 365. The report underscores that the attackers rely on manipulating end users rather than exploiting Salesforce vulnerabilities, and it calls for enhanced identity verification, live video identity proofing, and multi‑factor authentication measures.

With ShinyHunters among those named in connection with these operations, the piece stresses that organisations should implement strict third‑party verification and robust reporting channels to mitigate risk.