Phone calls that empty your CRM: the vishing wave
Attackers don't need to break software when they can talk someone into connecting a malicious app. Even Google was caught out. Here's how to protect your customer database.
By the Xuru Technologies team · 8 August 2025
Key takeaways
- In August 2025 Google confirmed that a group it tracks stole data from one of its corporate Salesforce instances.
- The wider campaign used voice phishing ("vishing") to trick employees into authorising malicious connected apps.
- Salesforce itself was not breached; attackers abused legitimate access granted by staff.
- App permissions, staff training and verification procedures are the key defences.
A friendly call from "IT support" asking you to approve an app or enter a code can hand over your whole customer list.
What happened
Axios and Infosecurity Magazine reported that Google was among the organisations affected by an ongoing data theft campaign targeting Salesforce environments through social engineering.
What it means for businesses
- Cloud tools are only as safe as their permissions. Connected apps can export data quickly.
- Phone calls bypass email filters. Staff need to know how real IT requests arrive.
- Customer data theft leads to scams targeting your customers in your name.
- Small CRMs face the same risks — HubSpot, Zoho, Pipedrive and others.
Protect your CRM
| Control | How |
|---|---|
| App approvals | Only admins can connect new apps; review connected apps quarterly |
| Verification | Staff call back on a known number before acting on IT requests |
| Least access | Limit who can export data |
| 2-step login | Required for every CRM user |
| Alerts | Notifications for large exports or new integrations |
Frequently asked questions
What is vishing?
Voice phishing — using phone calls to trick people into giving access, codes or approvals.
Was Salesforce hacked?
Reports indicated attackers abused legitimate access obtained through social engineering, rather than exploiting a flaw in Salesforce itself.
How do we train staff quickly?
A short session with real examples and one simple rule: never approve access or share codes based on an inbound call.
Connect your tools without opening the vault.
We integrate websites, forms and CRMs with least-privilege access, 2-step logins and alerts.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed
Leave a Reply