Security Firms Hit by Salesforce–Salesloft Drift Breach

Between August 8 and August 18, hackers used compromised OAuth tokens for the third-party AI chat bot Salesloft Drift to export large volumes of data from the Salesforce instances of hundreds of organizations.

Attributed to a threat actor tracked as UNC6395 by Google and GRUB1 by Cloudflare, the campaign was aimed at extracting credentials and other sensitive information, including AWS access keys, passwords, and Snowflake-related access tokens.

https://www.securityweek.com/security-firms-hit-by-salesforce-salesloft-drift-breach/