ClosedHighNo fix needed
Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)
Salesloft Drift integration (Salesforce, Google Workspace)
Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.
Why this severity: Third-party OAuth token theft; 700+ organizations potentially affected
- Started
- Aug 8, 2025
- Closed
- Sep 7, 2025
Affected
- Organizations with Drift connected to Salesforce or other apps
Fixed in
- Drift tokens revoked; rotate any secrets stored in Salesforce
Timeline4
Advisories1
News & write-ups4
- Widespread Data Theft Targets Salesforce Instances via Salesloft DriftGoogle Threat Intelligence · Write-up
- The impact of the Salesloft Drift breach on Cloudflare and our customersCloudflare · Write-up
- Threat Brief: Salesloft Drift Integration Used To Compromise Salesforce InstancesUnit 42 · Write-up
- Hundreds of Salesforce customers impacted by attack spree linked to third-party AI agentCyberScoop
Notes & caveats
GTIG blog date (Aug 26) and Cloudflare post date (Sep 2) from memory; closedAt approximates when disclosures wound down. Verify on the pages.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
