Hackers posed as Salesforce IT staff, using vishing to trick employees into installing malicious software for data theft and extortion.

Google’s Threat Intelligence Group says a vishing threat called UNC6040 has been targeting Salesforce applications with a fake data loader.