UNC6040 Vishing Campaigns Targets Salesforce for Data Theft
UNC6040, a threat group that specializes in voice phishing (vishing), has successfully gained access to over 20 organizations' Salesforce environments.
What Happened: The UNC6040 threat group recently infiltrated around 20 organizations. They posed as IT support and tricked employees into installing a malicious version of Salesforce’s Data Loader. This action gave attackers broader access to the organizations’ SaaS environments.
How the Attack Unfolded: UNC6040 specializes in vishing (voice phishing) campaigns. This is a type of social engineering, which manipulates human users into making security mistakes.
Attackers instructed employees to visit a real Salesforce page and approve the malicious version of the Data Loader app
By doing so, employees unintentionally exposed sensitive credentials and MFA codes
From there, attackers stole data from the organization’s Salesforce environment, before moving to other platforms like Okta, M365, and Workplace
Why This Matters: Customers and users play a critical role in making sure their environments are secure.
Speaking on the incident, Salesforce maintains that security is a shared responsibility between vendors and customers. While vendors like Salesforce maintain the security of the app’s underlying infrastructure, customers must control data access.
Taking a Step Back:
Humans are often the weakest link in the security chain. Despite robust technical safeguards, social engineering tactics like vishing exploit human vulnerabilities, leading to unintentional security breaches.
The interconnectedness of modern SaaS environments amplifies risk. A single compromised credential or access point can become a pivot point for attackers, allowing them to traverse across multiple SaaS applications and internal systems.
Prevention Methods:
General Strategies:
Educate staff on vishing and social engineering threats
Educate staff on fake SSO phishing sites
Ensure staff are only granted the permissions needed for their role
Control access to Connected Applications
Restrict access to named IP ranges
For Obsidian customers:
Monitor Obsidian alerts for any related to Salesforce or Okta
Use Obsidian’s Browser Extension to detect and automatically block Identity Takeovers (ATO) from advanced phishing kits (such as evilginx reverse proxy websites)
