How ShinyHunters Struck Google Through Salesforce: The Rise of Social Engineering Attacks on Tech Giants

In recent months, a troubling pattern has emerged in the cybercrime world: the ShinyHunters collective has been repeatedly breaching some of the world’s largest corporations by exploiting weaknesses in their Salesforce platforms. After making waves in 2024 with attacks on Snowflake, 2025 has seen ShinyHunters turn their sights on Salesforce, striking titans like Google, Cisco, and Adidas. What’s particularly alarming is that these attacks rely less on cutting-edge technical exploits and more on human error and social engineering — proving that even the most sophisticated defenses can fall prey to simple but patient manipulations.

the Incident

ShinyHunters, a notorious cybercrime group, has successfully stolen corporate data from Google via an attack on its Salesforce system. This breach is just one in a string of incidents impacting major global brands such as Adidas, Pandora, Allianz, Tiffany & Co., Dior, and Louis Vuitton. A common thread connecting these breaches is the exploitation of vulnerabilities within Salesforce, a popular third-party Customer Relationship Management (CRM) platform.

Google’s Threat Intelligence Group identified a subgroup called UNC6040, affiliated with ShinyHunters, which uses advanced voice phishing (vishing) tactics to manipulate employees into granting access. The attackers impersonate IT staff and convince employees to install a Trojanized version of the Salesforce “Data Loader” app, which gives them entry to sensitive customer environments.

Despite Google publicly sharing a detailed playbook to help defend against these attacks, ShinyHunters managed to breach Google’s own systems in June 2025. Although Google claimed only basic contact information was stolen, the incident highlights how layered security controls can crumble once insiders are manipulated to bypass them.

ShinyHunters is not a single group but rather a decentralized “brand” used by multiple threat actors to leverage the reputation of past high-profile breaches. This complicates efforts to track and attribute attacks, making it difficult for defenders to develop a consistent threat profile.

Last year, ShinyHunters primarily exploited weak credentials and the lack of multifactor authentication to breach Snowflake cloud storage systems. This year, their approach shifted toward social engineering, using human trust and patience rather than technical zero-day exploits to infiltrate corporate SaaS environments.

Industry experts stress the urgent need for more robust social engineering defenses — including phishing-resistant MFA, strict app allow-listing, anomaly detection in help desk operations, and multi-person approval processes for CRM data exports — to raise the bar and reduce the risk of similar breaches.

What Undercode Say:

The ShinyHunters saga perfectly illustrates the evolving nature of cyber threats in today’s cloud-dependent world. Their success shows that the weakest link in cybersecurity is often the human element, not the technology itself. Even tech giants like Google, armed with sophisticated security tools and public knowledge about the threat, fell victim because attackers exploited employee trust through social engineering rather than relying on undiscovered software vulnerabilities.

This trend signals a shift from traditional hacking—where cybercriminals search for exploitable bugs in software—to an era where deception and psychological manipulation take center stage. Social engineering attacks such as vishing and spear phishing are cheap, scalable, and difficult to defend against without comprehensive user training and advanced behavioral analytics.

The use of brand names like “ShinyHunters” by multiple, loosely affiliated groups further muddies the waters. This decentralized “brand model” is a clever strategy for criminals: it enhances their dark web credibility, inflates ransom demands, and psychologically pressures victims. But from a defender’s perspective, it creates a chaotic threat landscape where pinpointing attackers becomes a guessing game, complicating incident response and long-term threat intelligence gathering.

For corporations relying heavily on SaaS platforms like Salesforce, this means they must rethink their security models. Relying solely on platform-default security or standard MFA is no longer sufficient. Instead, organizations should adopt multi-layered defenses, including hardware-based MFA, strict access controls, network segmentation, and continuous monitoring for unusual app installations or user behaviors.

Moreover, red-team exercises simulating vishing attacks can help prepare employees to recognize and resist these tactics, while procedural safeguards like dual approvals for data exports can make unauthorized access more difficult to monetize.

The ShinyHunters case is a wake-up call: no company, regardless of size or reputation, is immune when human trust is weaponized. Cybersecurity must evolve beyond technology to address the psychological and organizational dimensions of security.

🔍 Fact Checker Results

✅ Verified: Google confirmed the Salesforce breach through its official blog and disclosed the involvement of UNC6040/ShinyHunters.
✅ Verified: ShinyHunters exploited social engineering and Trojanized Salesforce Data Loader apps rather than technical zero-day exploits.
❌ Unverified: Specific details about the exact volume of stolen data and full impact remain undisclosed by Google and Salesforce.

📊 Prediction

As ShinyHunters and similar groups refine their social engineering tactics, we can expect an increase in targeted voice phishing (vishing) and application spoofing attacks on SaaS platforms throughout 2025 and beyond. Cloud-first enterprises that fail to adopt hardware-backed MFA, app allow-listing, and comprehensive employee training will remain vulnerable to similar breaches. The decentralization of threat brands like ShinyHunters suggests future attacks will become harder to attribute, forcing cybersecurity teams to rely more on anomaly detection and behavioral analytics than on traditional signature-based defenses. Organizations that proactively build layered defenses against human manipulation will gain a critical edge in this emerging battlefield.