Google’s Threat Intelligence Group says a vishing threat called UNC6040 has been targeting Salesforce applications with a fake data loader.

Hackers are tricking employees at companies in Europe and the Americas into installing a modified version of a Salesforce-related app, allowing the hackers to steal reams of data, gain access to other corporate cloud services and extort those companies,

A hacking group has been impersonating IT personnel to break into companies’ Salesforce tools, using the access for data theft and extortion, according to a new report from Google’s threat intelligence group.