TLDR: Google recently fell victim to an AI-driven cyberattack, where a corporate Salesforce instance was compromised by the financially-motivated threat group UNC6040. Attackers leveraged generative AI to create highly convincing phishing emails and vishing calls, aiming to install malware and extract data. Google swiftly contained the breach, which affected basic contact information of small and medium businesses.
Google has confirmed it was the target of a sophisticated AI-driven cyberattack, with a corporate Salesforce instance being compromised by a financially-motivated threat cluster identified as UNC6040. The incident, reported on August 8, 2025, highlights the escalating use of artificial intelligence by cybercriminals to bypass traditional security measures and deceive users.
According to ITWeb, the attackers employed generative AI to craft highly realistic documents, emails, and phone calls. These AI-enhanced tactics allowed them to mimic familiar voices and create seemingly legitimate attachments, tricking recipients into installing malware on networks. Furthermore, vishing attacks involved pushing targets to click malicious links sent via SMS or WhatsApp, demonstrating a multi-pronged approach to infiltration.
Google, one of the ‘Magnificent Seven’ US tech companies, stated that it ‘responded to the activity, performed an impact analysis and began mitigations’ swiftly after detecting the breach. Access to the compromised system was cut off within a small window, limiting the extent of data exfiltration. The data retrieved was confined to basic and largely publicly available business information, such as business names and contact details, primarily affecting systems storing contact information and related notes for small and medium businesses.
This attack on Google follows a similar incident that targeted Microsoft SharePoint servers globally, underscoring a growing trend of AI-enabled cyber threats. Richard Cassidy, Europe, Middle East and Africa chief information security officer at Rubrik, commented on the surge in such incidents, attributing it to ‘a combination of rapidly-evolving AI-enabled attack tools, and the ever-expanding attack surfaces created by widespread digitalisation, without proportional investment in cyber resilience.’ Cassidy also noted that countries like South Africa are becoming ‘testing grounds for new threats’ due to digital transformation outpacing security maturity.
Also Read:
- The Rise of AI Agents and Escalating Cybersecurity Risks in Cloud Environments
- Researchers Demonstrate AI Vulnerability: Calendar Invite Used to Hijack Gemini and Control Smart Homes
While the initial summary mentioned Google’s AI agent ‘Big Sleep’ foiling an exploit, the detailed reports on this specific Salesforce breach do not link Big Sleep to its defense. However, Google’s ‘Big Sleep’ AI has been credited with significant cybersecurity achievements, such as discovering and preventing the exploitation of a critical SQLite 0-day vulnerability (CVE-2025-6965) in July 2025, marking a milestone as the first AI agent to directly thwart active cyber threats proactively. This broader context illustrates Google’s ongoing efforts to leverage AI for both offensive and defensive cybersecurity capabilities.
