THE COST OF A CALL: FROM VOICE PHISHING TO DATA EXTORTION

Summary from the TLDR InfoSec newsletter

Google Threat Intelligence Group (GTIG) reports on threat activity from a group tracked as UNC6040. The group uses vishing to impersonate IT support personnel in convincing attacks targeting employees in multinational corporations into granting access or sharing credentials to their Salesforce platform. In many campaigns, the threat actors convince the victim to add a modified version of the bulk data import tool, Salesforce Data Loader, which is modified to send the data to an attacker-controlled infrastructure.