Loading story…
In August 2025, attackers exploited OAuth tokens from Salesloft’s Drift integration, gaining access to hundreds of Salesforce and Google Workspace accounts. The campaign, attributed to UNC6395, bypassed traditional user-centric controls and enabled mass data exfiltration and credential harvesting, impacting a broad ecosystem of connected services. The incident highlights the urgent need for robust non-human identity governance, enhanced monitoring, and supply chain security practices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
permiso.io
Open sourceunit42.paloaltonetworks.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
In August 2025, attackers exploited a compromise of Salesloft's GitHub account to steal OAuth tokens from the Drift chatbot integration, enabling access to Salesforce data of over 700 organizations. Major security vendors including Qualys, Tenable, Proofpoint, Black Duck, BeyondTrust, Cloudflare, and Palo Alto Networks were affected, with attackers exfiltrating support case data, business contacts, and internal notes. The breach was contained after Drift was taken offline, credentials were rotated, and integrations were restored following forensic investigation.
Jun 29, 2026A breach of Salesloft's Drift application led to the theft of large volumes of Salesforce data and authentication tokens from potentially hundreds of organizations. The attack began with a compromise of Salesloft's GitHub account, followed by the exfiltration of OAuth tokens and sensitive credentials from Drift's AWS environment. Organizations affected are urged to rotate credentials and review logs for evidence of compromise.
Jun 29, 2026
Threat actors attributed as **UNC6395** used compromised OAuth tokens tied to the **Salesloft Drift** integration to access numerous customer **Salesforce** instances and systematically exfiltrate sensitive records, including **Account, Contact, Case, and Opportunity** data. The activity ran from at least **August 8 to August 18, 2025**, with investigators reporting that the attackers issued large volumes of Salesforce API requests, exported data in bulk, and in some cases deleted query jobs or queries to hinder detection. Google Threat Intelligence Group and Palo Alto Networks Unit 42 said the campaign was aimed not only at data theft but also at **credential harvesting**, with the stolen Salesforce data searched for secrets such as **AWS access keys, passwords, tokens, and Snowflake-related credentials** that could support follow-on compromise. Salesloft said it notified affected customers, while **Salesloft and Salesforce** revoked active Drift application access and refresh tokens on **August 20, 2025** and removed the Drift app from the Salesforce AppExchange during the investigation. Researchers emphasized that the incident did **not** stem from a flaw in the core Salesforce platform, but from abuse of third-party integration tokens in a broader SaaS supply-chain intrusion. Additional reporting said suspicious activity included logins from **`208.68.36[.]90`**, anomalous Salesforce API **GET**, **POST**, and **DELETE** requests, use of the user agent **`Python/3.11 aiohttp/3.12.15`**, and at least one case where a new user account was created for persistence; defenders were urged to review Salesforce, identity, and network logs and rotate any credentials exposed in the stolen data.
Jul 30, 2026