Voice phishing campaign uses fake Salesforce Data Loader to steal and extort corporate data

Google traces the UNC6040 operation to around 20 organizations, revealing months-long intrusions before extortion demands