How Hackers Fooled Google With a Simple Phone Call

Correction, October 11, 2026: This article has been updated to clarify the affected Google service, the breach scope, threat-group attribution, and the role of MFA. The operational examples below describe the wider campaign.

Google disclosed a June 2025 compromise of its corporate Salesforce instance involving largely public business contact information and notes. This was not a confirmed breach of two billion Gmail accounts (Google Threat Intelligence Group, 2025).

Google confirmed that no passwords or financial information were lost. Yet for defenders and attackers alike, the breach represents something bigger. It is proof that a social engineering tactic as old as the phone call can still puncture one of the most heavily defended companies in the world (Google Threat Intelligence Group, 2025).

Who Are the ShinyHunters?

ShinyHunters is not a new name in cybercrime. The group has been tied to dozens of high-profile breaches since 2020, including attacks on Microsoft’s GitHub repositories, Tokopedia, and Wattpad (ReliaQuest, 2025). They gained a reputation for selling stolen data on dark web forums, often opting for quick monetization instead of stealthy persistence.

Google tracks UNC6040 intrusion activity and UNC6240 follow-on extortion separately. UNC6240 has claimed the ShinyHunters name; the labels do not establish identical membership (Google Threat Intelligence Group, 2025).

Social engineering can undermine otherwise useful security controls. Approving a malicious connected app can grant access that survives a password change. MFA remains valuable, and application permissions require their own scrutiny (Federal Bureau of Investigation, 2025).

Offensive Tradecraft Exposed

The following section discusses techniques reported across the broader Salesforce campaign. It should not be read as a reconstruction of every step in Google's individual incident.

Once installed, the fake Data Loader prompted the user to authenticate with their Salesforce credentials, granting the malicious app OAuth token permissions identical to those of the real tool. These tokens gave the attackers programmatic access to the targeted Salesforce environment without triggering MFA prompts (Vorlon, 2025). From there, the attackers quietly ran test queries to confirm access, then escalated to bulk exports of customer contact data using Salesforce’s own APIs. Because the activity looked like a legitimate employee using a standard tool, it blended in with normal business operations until exfiltration was complete (Obsidian Security, 2025).

From an offensive perspective, this campaign is a case study in low-cost, high-impact red-teaming turned real.

Vishing as Initial Access. In the broader campaign, attackers impersonated IT support to persuade employees to grant access. Defenders should verify requests through a separate, known channel.

Trojanized Data Loader. Instead of malware hidden in an email attachment, the attackers weaponized a legitimate Salesforce tool. Once installed, it exfiltrated CRM data using Salesforce’s own APIs. Because it was authenticated with OAuth tokens, it bypassed repeated interactive MFA prompts after app authorization (Google Threat Intelligence Group, 2025).

Token Persistence. The malicious connected apps held wide-scoped OAuth tokens, which allowed the attackers to return at will without re-authenticating. This made the breach resilient to password resets unless tokens were explicitly revoked (Vorlon, 2025).

Stealth Exfiltration. In many incidents tied to this campaign, the attackers tested their access with small data pulls before moving to bulk exports. This low-and-slow tactic avoided immediate detection (Vorlon, 2025).

Cross-Platform Reach. Once footholds in Salesforce were established, attackers attempted lateral moves into linked Okta or Microsoft 365 environments, leveraging token access and overlapping accounts (Google Threat Intelligence Group, 2025).

Why This Matters Offensively

For authorized security testing, this campaign highlights the importance of evaluating approval workflows and SaaS integrations alongside technical vulnerabilities. Social engineering exercises should measure whether employees can pause and verify a request, and whether application permissions are limited and monitored.

Defensive Takeaways

The breach also offers valuable defensive lessons.

Audit Connected Apps. Organizations must strictly control which apps can be installed in Salesforce or any SaaS platform. Remove unused apps and carefully vet new ones (Vorlon, 2025).

Monitor Event Logs. Salesforce provides logs that can flag suspicious Bulk API calls or unusual login locations. Consistent monitoring could have caught the anomaly earlier (Vorlon, 2025).

Vishing Awareness. Employee training often focuses on email phishing, but voice phishing simulations are just as important. Staff must know how to verify internal IT requests independently.

Token Governance. Security teams need policies to revoke OAuth tokens immediately during incident response. Password resets are not enough (Obsidian Security, 2025).

Limit Admin Rights. Only a small, vetted set of users should have the ability to install or approve connected apps.

Could Your Organization Be Next?

If your company uses Salesforce or other SaaS CRMs, here are the questions worth asking right now:

Do we know exactly which connected apps have been installed in our environment?

Are we monitoring for unusual data exports or Bulk API jobs?

Have we run vishing simulations with employees who have elevated privileges?

Do we have an incident response plan that includes token revocation?

If you cannot answer yes to all of these, you might already be vulnerable.

Closing Thoughts

The practical lesson is that trusted workflows deserve scrutiny. A convincing request can cause a user to authorize access that appears legitimate. Defenders need both verification habits and technical controls around connected applications.

References

Axios. (2025, August 6). Google ShinyHunters Salesforce data breach. Axios. https://www.axios.com/2025/08/06/google-shinyhunters-salesforce-data-breach

Google Threat Intelligence Group. (2025, June 4). The cost of a call: From voice phishing to data extortion. Google Cloud. https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion

Obsidian Security. (2025, August). ShinyHunters and Scattered Spider: Salesforce attacks. Obsidian Security Blog. https://www.obsidiansecurity.com/blog/shinyhunters-and-scattered-spider-a-merger-of-chaos-in-the-2025-salesforce-attacks

ReliaQuest. (2025, August). ShinyHunters data breach and Salesforce targeting. ReliaQuest Blog. https://reliaquest.com/blog/threat-spotlight-shinyhunters-data-breach-targets-salesforce-amid-scattered-spider-collaboration

The Hacker News. (2025, June). Google exposes vishing group UNC6040. The Hacker News. https://thehackernews.com/2025/06/google-exposes-vishing-group-unc6040.html

Vorlon. (2025, August). ShinyHunters Salesforce response tips. Vorlon Blog. https://blog.vorlon.io/shinyhunters-salesforce-response-tips

Federal Bureau of Investigation. (2025, September 12). Cyber criminal groups UNC6040 and UNC6395 compromising Salesforce instances for data theft and extortion [FLASH alert]. https://www.fbi.gov/file-repository/cyber-alerts/cybercriminal-groups-unc6040-and-unc6395-compromising-salesforce-instances-for-data-theft-and-extortion-091225.pdf