Tokens stolen from Salesloft's Drift chat agent used to raid hundreds of Salesforce orgs
From at least 8 to 18 August 2025, a threat actor tracked by Google as UNC6395 used OAuth tokens stolen from Salesloft's Drift chat-agent platform to export large volumes of data from customers' Salesforce instances, then searched it for secrets such as AWS keys, passwords and Snowflake tokens. Salesloft and Salesforce revoked the Drift tokens on 20 August, and victims including Cloudflare disclosed exposed customer data.
Salesloft's Mandiant-led investigation found the attacker had accessed Salesloft's GitHub account between March and June 2025 before reaching Drift's AWS environment and the customer tokens. Google later advised treating every token connected to Drift as compromised after finding Drift Email tokens had also been used to access a small number of Google Workspace accounts.
What would have stopped it
Scope and monitor the tokens that third-party agents hold so one vendor breach cannot export every customer's CRM data.
Guardrails
- G1 Least privilege Failed Long-lived integration tokens allowed bulk exports of customer Salesforce data.
- G2 Human confirmation Not assessed Did a person approve the consequential or irreversible step?
- G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
- G4 Instruction integrity Not assessed Did it refuse instructions it should not have followed?
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
- G7 Oversight Failed Intruders were in Salesloft systems from March to June; exports ran ten days before revocation.
- G8 Recovery Partial Tokens were revoked, but exfiltrated data and any secrets inside it could not be recalled.
Sources
-
“Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft Drift third-party application.”
-
“As part of the breach, the threat actor was able to obtain OAuth credentials associated with the Salesloft Drift chat agent’s Salesforce integration to exfiltrate data from Salesloft customers’ Salesforce instances.”
-
“And then they accessed Drift's AWS environment and obtained OAuth tokens for Drift customers' technology integrations.”
Confidence 96% comes from these sources alone. How we score
History
- 14 Oct 2026Entered in the register with 3 sources