# Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395) · pwn.watch

> Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.

Page: https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025 · generated 2026-10-23T03:54:42.456Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Salesloft Drift integration (Salesforce, Google Workspace)
- Started: 2025-08-08 · closed: 2025-09-07
- Affected: Organizations with Drift connected to Salesforce or other apps
- Fixed in: Drift tokens revoked; rotate any secrets stored in Salesforce

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025/feed.xml
- JSON Feed: https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025.json
- This file: https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025/llms.txt

## Updates (newest first)
- 2025-09-02: Cloudflare details the impact on its Salesforce case data (https://blog.cloudflare.com/response-to-salesloft-drift-incident/)
- 2025-08-26: Google Threat Intelligence publishes UNC6395 findings (https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift)
- 2025-08-20: Salesloft and Salesforce revoke Drift access and refresh tokens; Drift pulled from AppExchange (https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift)
- 2025-08-08: Data theft from Salesforce instances begins (through Aug 18) (https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift)

## Fix brief
# Security brief: Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)

Source: https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025 · status: closed (closed Sep 7, 2025) · severity: high · updated Sep 7, 2025

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.

Severity detail: Third-party OAuth token theft; 700+ organizations potentially affected

- Product: Salesloft Drift integration (Salesforce, Google Workspace)

## Affected versions
- Organizations with Drift connected to Salesforce or other apps

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Drift tokens revoked; rotate any secrets stored in Salesforce

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Sep 2, 2025: Cloudflare details the impact on its Salesforce case data
- Aug 26, 2025: Google Threat Intelligence publishes UNC6395 findings
- Aug 20, 2025: Salesloft and Salesforce revoke Drift access and refresh tokens; Drift pulled from AppExchange
- Aug 8, 2025: Data theft from Salesforce instances begins (through Aug 18)

## Advisories
- [Cybersecurity Alert – Salesloft Drift AI Supply Chain Attack](https://www.finra.org/rules-guidance/guidance/salesloft-drift-AI-supply-chain-attack) (FINRA)

## Write-ups & news
- [Widespread Data Theft Targets Salesforce Instances via Salesloft Drift](https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift)
- [The impact of the Salesloft Drift breach on Cloudflare and our customers](https://blog.cloudflare.com/response-to-salesloft-drift-incident/)
- [Threat Brief: Salesloft Drift Integration Used To Compromise Salesforce Instances](https://unit42.paloaltonetworks.com/threat-brief-compromised-salesforce-instances/)
- [Hundreds of Salesforce customers impacted by attack spree linked to third-party AI agent](https://cyberscoop.com/salesforce-salesloft-drift-attack-spree-google/)

## Caveats
GTIG blog date (Aug 26) and Cloudflare post date (Sep 2) from memory; closedAt approximates when disclosures wound down. Verify on the pages.

---
Machine-readable: https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.