Salesloft Drift OAuth Token Breach Exposes Salesforce and Google Workspace Data

In late August 2025, Google Threat Intelligence Group (GTIG) revealed a major cybersecurity incident involving the Salesloft Drift platform. A sophisticated threat actor, tracked as UNC6395, abused compromised OAuth tokens to steal data from corporate Salesforce instances and access emails in Google Workspace accounts linked to Drift.

This Salesloft Drift security breach highlights the growing risks of third-party integrations and token-based authentication. Even though Salesforce and Google Workspace themselves were not compromised, the stolen tokens gave attackers a dangerous backdoor into sensitive business data.

What Happened in the Salesloft Drift Compromise?

• August 8 – August 18, 2025: Attackers began abusing OAuth tokens tied to Salesloft Drift’s Salesforce integration, exfiltrating large volumes of data.
• August 9, 2025: OAuth tokens from the Drift Email integration were exploited to access a small number of Google Workspace accounts (only those specifically configured with Drift).
• August 20, 2025: Salesforce and Salesloft revoked all Drift tokens and removed the Drift app from Salesforce AppExchange.
• August 28, 2025: GTIG confirmed the scope was broader than Salesforce and urged all Drift customers to assume any connected integrations were potentially compromised. Google revoked tokens, disabled Drift Email integration, and notified impacted Workspace administrators.

What Data Was Targeted?

UNC6395 focused on credentials and sensitive secrets inside Salesforce exports, including:

• AWS Access Keys (AKIA identifiers)
• Snowflake database tokens
• Usernames, passwords, and API keys
• Company records like Accounts, Users, Opportunities, and Cases

The attackers used targeted SOQL queries to harvest credentials. For example:

SELECT Id, Username, Email, LastLoginDate 
FROM User 
WHERE IsActive = true 
ORDER BY LastLoginDate DESC 
LIMIT 20;

Even though attackers tried to cover their tracks by deleting some jobs, Salesforce logs remain intact for forensic review.

Why This Matters

This incident is one of the largest OAuth token compromises observed in recent years. It shows that:

• Third-party integrations can be the weakest link in cloud security.
• OAuth tokens, once stolen, can give attackers persistent, legitimate access without triggering normal login alerts.
• Even trusted platforms like Salesforce and Google Workspace are vulnerable through ecosystem risks, not through flaws in their core products.

How to Protect Your Organization

If your company uses Salesloft Drift with Salesforce, Google Workspace, or any other platform, you must assume compromise and take immediate action.

1. Revoke and Rotate Credentials

• Revoke all OAuth tokens linked to Drift.
• Rotate API keys, access tokens, and passwords.
• Apply shorter session lifespans in Salesforce.

2. Investigate for Unauthorized Access

• Review Salesforce Event Monitoring logs and Drift Connected App activity.
• Search for suspicious SOQL queries in logs.
• Scan exported data for AWS keys, Snowflake credentials, and passwords using tools like Trufflehog.

3. Harden Access Controls

• Restrict Drift and other apps to least privilege scopes.
• Enforce IP restrictions and login ranges for connected apps.
• Remove unnecessary “API Enabled” permissions from user profiles.

Official Response

• Google revoked compromised tokens, disabled the Drift Email integration, and notified Workspace admins.
• Salesforce revoked Drift access and removed the app from the AppExchange.
• Salesloft has engaged Mandiant to assist with the investigation and continues to update customers via its Trust Center.

The Salesloft Drift security incident underscores the importance of third-party risk management. Even without a breach of Salesforce or Google, attackers exploited OAuth token trust relationships to steal valuable data.

Organizations should review all Drift integrations immediately, rotate all credentials, and audit logs for signs of compromise.

For ongoing updates, monitor:

• Salesforce Trust & Security

Source: https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift?hl=en

Corentin C

Founder of ToolsLib, Designer, Web and Cybersecurity Expert.
Passionate about software development and crafting elegant, user-friendly designs.