Payback: 'ShinyHunters' Clocks Google via Salesforce

The report describes ShinyHunters/UNC6040 conducting an active campaign of Salesforce-focused intrusions using sophisticated vishing and social-engineering to convince employees to install Trojanized connectors or run custom scripts, enabling theft of customer contact and business data across numerous major organisations (including Google); it highlights evolving TTPs (VPN/TOR, modified Data Loader, custom Python tooling), the brand-like decentralization of the group, and recommended defensive measures such as phishing-resistant MFA, allow-listing connected apps, and stricter access controls.