Google has sounded the alarm to its 2.5 billion Gmail users worldwide, urging them to take immediate precautions against a sophisticated new cyber threat. According to the tech giant, a notorious hacker collective known as ShinyHunters is behind a growing wave of scams that originated from a third-party security incident involving Salesforce’s cloud platform.

The breach, initially dismissed as exposing only “basic and largely publicly available business information,” is now being weaponized in far more dangerous ways. Google’s Threat Intelligence Group (TAG), which first detected the attacks in June, revealed that cybercriminals are using the stolen data to launch highly targeted phishing campaigns, social engineering schemes, and extortion attempts.

One of the most alarming tactics involves impersonating corporate IT support staff over the phone—a technique Google says has proven “particularly effective in tricking employees.” Attackers prey on English-speaking workers in multinational corporations, convincing them to share login credentials, reset accounts, or even provide access codes.

By August, Google confirmed multiple “successful intrusions” had already occurred due to compromised passwords. In some cases, victims faced threats of extortion, with hackers demanding payment in Bitcoin within a 72-hour window.

Who Are the ShinyHunters?

The ShinyHunters first appeared in 2020, borrowing their name from the Pokémon universe, but their actions have been anything but playful. The group has been linked to several high-profile breaches, targeting major corporations such as AT&T Wireless, Microsoft, Santander, and Ticketmaster.

In Google’s latest warning, TAG stated: “We believe threat actors using the ‘ShinyHunters’ brand may be preparing to escalate their extortion tactics by launching a data leak site (DLS). These new tactics are likely intended to increase pressure on victims, including those associated with the recent UNC6040 Salesforce-related data breaches.”

This evolution of strategy, referred to internally as UNC6240, shows how the group is adapting its approach to maximize financial gain while causing reputational harm to its victims.

How the Attacks Unfold

Unlike traditional phishing emails that often end up in spam folders, these attackers are focusing on direct, human interaction. By posing as trusted IT personnel over the phone or in emails, they exploit employees’ natural willingness to cooperate with supposed support staff.

Google explains that these social engineering methods often succeed because they bypass typical email filters. Instead of malicious links or attachments, the attackers rely on manipulation, fear, and urgency to coerce victims into giving up sensitive information.

Once inside, hackers leverage stolen data to threaten organizations with data leaks, paralyzing business operations and forcing companies into a corner.

Google’s Response and Safety Measures for Users

On August 8, Google notified all potentially affected users via email and issued an urgent set of recommendations to enhance security. The company emphasized three key measures for protection:

1. Update passwords regularly across all accounts, especially if the same login credentials are used across multiple platforms.

2. Enable two-factor authentication (2FA) to add an extra barrier of protection against unauthorized logins.

3. Remain vigilant against unsolicited phone calls or emails claiming to be IT support staff, even if they sound convincing.

Google also reassured users that its security teams continue to monitor the activities of ShinyHunters closely: “We continue to monitor this actor and will provide updates as appropriate.”

The Bigger Picture: A Global Cybersecurity Wake-Up Call

This latest escalation highlights the increasing sophistication of cybercrime, where stolen information from one breach can snowball into widespread attacks affecting millions—or even billions—of people.

Experts warn that organizations must not only invest in stronger cybersecurity infrastructure but also train employees to recognize and resist social engineering attempts. As hackers shift toward psychological manipulation rather than just technical exploits, awareness has become the first line of defense.

For everyday Gmail users, the message is clear: cyber threats are no longer distant risks—they are already at your digital doorstep.