https://pwn.watch/t/salesloft Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Sun, 07 Sep 2025 00:00:00 GMT https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025 https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025 Sun, 07 Sep 2025 00:00:00 GMT high <p>Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed · <strong>Fixed in:</strong> Drift tokens revoked; rotate any secrets stored in Salesforce</p> <p><strong>Latest updates:</strong></p><ul><li>2025-09-02: Cloudflare details the impact on its Salesforce case data (<a href="https://blog.cloudflare.com/response-to-salesloft-drift-incident/">source</a>)</li><li>2025-08-26: Google Threat Intelligence publishes UNC6395 findings (<a href="https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift">source</a>)</li><li>2025-08-20: Salesloft and Salesforce revoke Drift access and refresh tokens; Drift pulled from AppExchange (<a href="https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift">source</a>)</li></ul>