Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395) ยท updates https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025 Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange. en Tue, 02 Sep 2025 00:00:00 GMT Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395): Cloudflare details the impact on its Salesforce case data https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025 https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025#2025-09-02-ffdbbd5f Tue, 02 Sep 2025 00:00:00 GMT high <p><a href="https://blog.cloudflare.com/response-to-salesloft-drift-incident/">Source</a></p> Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395): Google Threat Intelligence publishes UNC6395 findings https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025 https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025#2025-08-26-2b9a84d6 Tue, 26 Aug 2025 00:00:00 GMT high <p><a href="https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift">Source</a></p> Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395): Salesloft and Salesforce revoke Drift access and refresh tokens; Drift pulled from AppExchange https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025 https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025#2025-08-20-cfcb892e Wed, 20 Aug 2025 00:00:00 GMT high <p><a href="https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift">Source</a></p> Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395): Data theft from Salesforce instances begins (through Aug 18) https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025 https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025#2025-08-08-2fb19734 Fri, 08 Aug 2025 00:00:00 GMT high <p><a href="https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift">Source</a></p>