Widespread Salesforce Data Theft via Compromised Salesloft Drift OAuth Tokens

On August 20, 2025, Salesloft published an advisory describing a security issue potentially affecting the Salesloft Drift integration with Salesforce. On August 26, Google Threat Intelligence Group (GTIG) provided additional details about the campaign, in which a threat actor known as UNC6395 authenticated against Salesforce customer instances using compromised OAuth tokens tied to the Salesloft Drift integration with Salesforce. The malicious activity, observed between August 8 and at least August 18, resulted in the exfiltration of large volumes of data from multiple corporate Salesforce instances.

https://arcticwolf.com/resources/blog/widespread-salesforce-data-theft-via-compromised-salesloft-drift-oauth-tokens/