Breaches and incidentsBriefChecked against a primary source
Salesloft Drift OAuth tokens used against Salesforce (UNC6395)
8 to 18 Aug 2025. Stolen Drift OAuth and refresh tokens were used to bulk-export Salesforce objects, which were then searched for AKIA keys, passwords and...
- Disclosed
What happened
- 8 to 18 Aug 2025. Stolen Drift OAuth and refresh tokens were used to bulk-export Salesforce objects, which were then searched for AKIA keys, passwords and Snowflake tokens. Tokens were revoked 20 Aug. The Drift Email integration was also abused.
- Scale: “numerous” instances per Google. Later estimates are about 700 to 760 organizations, including Cloudflare, Zscaler and Palo Alto Networks.
Sources
- https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift
- https://trust.salesloft.com/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.