erroneo.us
Search all guides⌘K

Security Digest · Aug 26, 2025 · Breach · Cloud

Salesloft Drift OAuth Token Theft Hits Salesforce Orgs

UNC6395 used stolen Salesloft Drift OAuth tokens to bulk-export Salesforce data in Aug 2025, hunting for secrets. Former Drift customers: confirm rotation.

Published By erroneo.us Security Desk · Updated 3 min read5 sources

Our verdict

Check exposure

Contained since September 2025, but if your org ever connected Drift, verify that every token and every secret sitting in your CRM or support cases was rotated, because the theft was aimed at exactly those secrets.

Who must act: Organizations that connected Salesloft Drift to Salesforce, Google Workspace or other systems before September 2025, and anyone who pasted credentials into Salesforce support cases or records.

Who can relax: Organizations that never used Drift; customers of affected vendors only need to watch for targeted phishing and rotate any secrets they shared in vendor support tickets.

Affected
Salesforce instances connected to the Salesloft Drift app (activity Aug 8–18, 2025)
Google Workspace accounts configured for the Drift Email integration (accessed Aug 9, 2025)
All authentication tokens stored in or connected to Drift
Fixed in
Drift access and refresh tokens revoked by Salesloft and Salesforce on Aug 20, 2025
Drift taken offline and credentials rotated; brought back online Sept 16, 2025
CVSS
Not scored
EPSS
n/a
CISA KEV
Not listed
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Confirm whether Drift was ever connected to your Salesforce, Google Workspace or other tenants, and remove integrations you no longer use.
  2. Rotate every credential, API key and OAuth token that was connected to Drift, and any secret found in Salesforce data.
  3. Search Salesforce objects (Cases, Accounts, Contacts, Opportunities) for secrets such as AKIA keys, Snowflake tokens and passwords using TruffleHog or GitLeaks.
  4. Restrict Connected App scopes, enforce IP restrictions on Connected Apps, and remove API Enabled from broad profiles.
  5. Warn support and sales staff about targeted phishing using stolen contact and case data.

How to check if you are affected or compromised

  • Review Salesforce Event Monitoring UniqueQuery and login history from Aug 8, 2025 onward for the Drift connection user.
  • Search logs for the user agents Salesforce-Multi-Org-Fetcher/1.0, Salesforce-CLI/1.0, python-requests/2.32.4 and Python/3.11 aiohttp/3.12.15.
  • Look for API access from 208.68.36.90, 44.215.108.109 and Tor exit nodes, and for Bulk API export jobs that were deleted afterwards.
  • Check cloud provider logs for use of any secret that appeared in Salesforce records.

What happened#

On August 26, 2025, Google's Threat Intelligence Group disclosed that an actor it tracks as UNC6395 had used stolen OAuth tokens for the Salesloft Drift chat app to break into many companies' Salesforce instances. The activity ran from as early as August 8 through at least August 18, 2025. Using SOQL queries, the actor exported large volumes of data from Cases, Accounts, Users and Opportunities. It then searched the stolen data for secrets such as AWS access keys (AKIA…), passwords and Snowflake tokens, and deleted its query jobs to cover its tracks. Google stressed that this was not a vulnerability in Salesforce itself.

Salesloft and Salesforce revoked all Drift access and refresh tokens on August 20. On August 28, Google widened the scope: the actor had also stolen tokens for the "Drift Email" integration and read mail from a very small number of Google Workspace accounts on August 9. Google advised treating every token stored in or connected to Drift as compromised.

The root cause came from the Mandiant investigation that Salesloft published. Between March and June 2025, the actor had access to Salesloft's GitHub account, downloaded repositories, added a guest user and set up workflows. It then got into Drift's AWS environment and took customers' OAuth tokens. Mandiant put the intrusion window at March 22 to September 5, 2025. Salesloft took Drift offline and brought it back on September 16.

Who is affected#

Any organization that connected Drift to Salesforce or other systems. Many security vendors confirmed exposure. Cloudflare said its Salesforce support cases were exported via Bulk API 2.0 on August 17, and it found and rotated 104 Cloudflare API tokens in the stolen data. Zscaler reported exposure of business contact details, licensing information and support case headers. Cloudflare said hundreds of organizations were targeted. No authoritative total victim count was disclosed as of 2026-10-21.

Do you really need to act?#

The original intrusion is over: tokens were revoked, Drift was rebuilt, and Mandiant reported no ongoing compromise. What lingers is the stolen data. The actor's goal was credential harvesting. Any secret that sat in a Salesforce record or support case, such as an API key a customer pasted into a ticket or a password in a case note, may still be valid somewhere if nobody rotated it.

If you were a Drift customer, the honest bar is this: can you show that every Drift-connected credential and every secret found in your CRM was rotated after August 2025? If not, do it now. If you were never a Drift customer but use an affected vendor, rotate anything you shared in their support tickets and expect convincing phishing that quotes real case details.

What to do now#

  1. Check Salesforce Setup > Connected Apps OAuth Usage, and your Google Workspace third-party app list, for Drift. Remove anything unused.
  2. Rotate all credentials, API keys and OAuth tokens that were ever connected to Drift.
  3. Scan exported Salesforce objects for secrets with trufflehog filesystem ./export or GitLeaks. Search for AKIA, snowflakecomputing.com, password and secret, and rotate whatever you find.
  4. Harden Salesforce: minimal Connected App scopes (avoid full), "Enforce IP restrictions" on Connected Apps, Login IP Ranges, and API Enabled granted only through permission sets.
  5. Brief support and sales teams on phishing that cites real case numbers or contracts.

How to tell if you were hit#

Salesloft says it notified all impacted customers. Independently, review Salesforce Event Monitoring (UniqueQuery) and login history from August 8, 2025 for the Drift integration user. Search for the user agents Salesforce-Multi-Org-Fetcher/1.0, Salesforce-CLI/1.0, python-requests/2.32.4 and Python/3.11 aiohttp/3.12.15, plus the IPs 208.68.36.90 and 44.215.108.109 and Tor exit nodes. Unit 42 warns that Tor indicators produce false positives. Bulk exports followed by deleted jobs are the strongest signal.

Timeline#

  • — Earliest intrusion activity Mandiant identified. GitHub access continues through June.
  • — Salesforce data theft begins and runs through at least August 18.
  • — Salesloft and Salesforce revoke Drift tokens.
  • — GTIG publishes its advisory, expanded on August 28.
  • — Drift is brought back online.
  • — Mandiant investigation and remediation conclude.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Google Threat Intelligence Group — Widespread Data Theft Targets Salesforce Instances via Salesloft Drift cloud.google.com
  2. Salesloft — Trust Center incident updates and Mandiant investigation summary trust.salesloft.com
  3. Cloudflare — The impact of the Salesloft Drift breach on Cloudflare and our customers blog.cloudflare.com
  4. Zscaler — Salesloft Drift supply chain incident: key details and Zscaler's response zscaler.com
  5. Palo Alto Networks Unit 42 — Threat brief: compromised Salesforce instances unit42.paloaltonetworks.com