Hackers abuse modified Salesforce app to steal data, extort companies, Google says

Google reports that the hacking group UNC6040 is using a modified version of Salesforce's Data Loader app to steal data and extort companies across Europe and the the Americas. Hackers are using social engineering via voice calls to trick employees into installing the malicious app, granting them access to sensitive data and potentially other cloud services. While Salesforce claims the issue is not a vulnerability in their platform and affects only a small subset of customers, Google estimates roughly 20 organizations have been impacted over the past several months.

Analysis

Google's Threat Intelligence Group has identified a hacking campaign, tracked as UNC6040, targeting companies in Europe and the Americas by deceiving employees into installing a modified Salesforce Data Loader application. This malicious app, distributed via social engineering tactics including voice calls, grants attackers significant capabilities to access, query, and exfiltrate sensitive data from compromised Salesforce environments, potentially enabling extortion and lateral movement to other corporate cloud services and internal networks. Approximately 20 organizations have reportedly been affected over several months, with a subset experiencing data exfiltration. Salesforce (CRM), which has a per-ticker sentiment of -0.4 reflecting a negative view on this news, maintains that this issue does not stem from an inherent platform vulnerability but rather exploits gaps in individual users' cybersecurity awareness. Salesforce characterized it as social engineering, stating it affects a "small subset" of customers and is "not a widespread issue." According to the article, Salesforce had warned customers about voice phishing and malicious Data Loader versions in a March 2025 blog post. The overall sentiment surrounding this news is moderately negative, though the reported market impact score is low at 0.3, suggesting limited immediate market-wide concern.

Key Decisions for Investors

• Investors in Salesforce (CRM) should monitor for further disclosures regarding the scope of this incident, any potential financial or reputational impact, and whether the number of affected clients or the severity perception changes from Salesforce's current assessment.
• Companies utilizing Salesforce or similar enterprise SaaS platforms should urgently review and reinforce their cybersecurity awareness training, particularly concerning social engineering tactics like vishing, and rigorously vet permissions granted to third-party connected applications.
• This incident underscores the persistent cyber threats to enterprise software; institutional investors should consider the robustness of cybersecurity measures and incident response capabilities as a key due diligence point for companies heavily reliant on cloud services and third-party ecosystems.