Salesloft’s integration with Drift AI has been hacked. The burglary resulted in the theft of OAuth tokens that may have been used to gain unauthorized access to Salesforce’s customer environments. This eventually led to the exposure of the crucial data of various organizations. Various Google Workspace emails and Azure access keys might have been exposed. This breach lays emphasis on the fact of how vulnerable the SaaS era is.
Silent Intrusion: The Breach That Went Unnoticed
The Google Threat Intelligence Group (GTIG) has reportedly identified a series of attacks, codenamed UNC6395, launched between August 8 and August 18, 2025. They didn’t launch a direct attack on Salesforce; instead, they utilized the trust link between Drift’s AI integration and Salesloft.
This clever tactic provided them with access to OAuth tokens, which were the gateways to the instances used by Salesforce customers. This was a chained process by which hackers silently stole a hefty amount of confidential data, making it the largest OAuth breach of this year.
Magnitude of Exposure
It is suggested that the attack impacted over 700 organizations globally. The hackers didn’t stop at data visibility but illicitly hauled valuable credentials such as:
- AWS access keys
- Database login credentials and passwords
- Snowflake access tokens
These credentials can enforce major attacks, increasing immense vulnerabilities in firms that are dependent on cloud systems.
Masked Intrusion, Detectable Patterns
Operational security stood still in this attack. After extracting the crucial assets of Salesforce, the attackers removed query jobs to veil their tracks. However, they didn’t succeed in their efforts; some of the logs remained intact. This helped the investigators to find important evidence of the breach.
Security analysts have cautioned that such attackers move slowly and silently, rather than speeding up to remain undetected for a prolonged period. To avoid being perceived as suspicious
Critical Mitigation Process
Soon after the breach was discovered, Salesloft and Salesforce took immediate actions to limit the damage. They revoked all OAuth and refresh tokens on August 20th, 2025. To protect it from further attacks, Salesforce unindexed Drift from the App Exchange.
While addressing the public, Salesloft informed that the breach was confined to those customers who had enabled Drift-Salesforce integration. It also assured its customers that no suspicious activities were discovered after the revocation of tokens. However, GTIG is still warning all affected organizations to make further operations on the assumption that their Salesforce data has been hacked.
It has also suggested measures to combat threats, such as revoking the API tokens, rotating the credentials saved across the cloud systems, and checking log reviews to detect suspicious activities or trace some evidence of the breach.
Conclusion
Although the immediate threat has been mitigated, its impact will last for several months. It is possible that the attackers might sell those stolen credentials on the dark web, which could result in serious fraud.
As of now, it is being advised that the companies that enabled Drift integration with Salesforce must remain vigilant. They must keep an eye on suspicious activities and install advanced monitoring tools to secure their confidential information from potential attackers.
