Hackers steal data from Salesforce instances in widespread campaign

Hackers stole user credentials from Salesforce customers in a widespread campaign earlier this month, according to researchers at Google Threat Intelligence Group, who warned that the thefts could lead to follow-up attacks.

A threat actor that Google tracks as UNC6395 targeted Salesforce instances using compromised OAuth tokens that were associated with the customer engagement vendor Salesloft’s Drift AI chat agent.

https://www.cybersecuritydive.com/news/hackers-steal-data-salesforce-instances/758676/