Google’s Threat Intelligence Group reported on a data breach that ended up affecting Google itself
GTIG said that the attacks targeted English-speaking employees working for Salesforce clients and used voice phishing to trick the employee into connecting a modified version of Salesforce’s Data Loader application. The aforementioned English-speaking employees received phone calls from someone claiming to be IT support personnel, telling the targeted employee to accept a connection to the client application known as Salesforce Data Loader.
As its name suggests, this is a key tool used by administrators and developers at Salesforce looking to import, export, update, or delete a large amount of data. Because the organizations being targeted by the attackers are Salesforce clients and use its CRM platform, the request from the bad actors to install the Data Loader doesn’t appear to be unusual. To connect the victim with the attackers, the latter persuades the victim on the phone to open the Salesforce Connect setup page and enter an 8-digit connection code. This connects the victim to the attacker.
Google itself became a victim of this attack in June when one of its Salesforce CRM installations was breached and customer data stolen. Bleeping Computer spoke with ShinyHunters this past Wednesday and was told that it breached several Salesforce instances, including one related to a trillion-dollar company. The threat actor said that it might decide to just leak the data from that company instead of using it to extort the firm. It is not known for sure whether that company is Google, even though the description fits.
Other companies being attacked are extorted through email, with the threat actor demanding that they pay a ransom in order to keep the data from getting publicly leaked.
Google has been getting hit from all sides lately
The CEO of Closed Door Security, William Wright, said, “The news that Google has suffered a data breach in the recent wave of attacks executed by ShinyHunters highlights that no organization is immune to cybercrime. It doesn’t matter if you are a small business or one of the world’s leading technology firms, all organizations are vulnerable.”
With AI becoming more accessible through free apps and websites, many are turning to ChatGPT, Gemini, and other AI apps to get more detailed responses than those available from Google Search which is the leading search engine in the world with a market share approaching 90%.
