Vishing Crew Targets Salesforce Data

Google-tracked group UNC6040 is running a vishing campaign that impersonates IT/support staff to trick employees into approving a malicious connected app (a modified Salesforce Data Loader) in their Salesforce instances, enabling immediate data exfiltration, lateral movement to services like Okta and Microsoft365, and later extortion; mitigations recommended include least-privilege access, IP restrictions, and MFA.