Widespread Data Theft Targets Salesforce Instances via Salesloft Drift

From August 8 to August 18, 2025, the threat actor tracked as UNC6395 conducted a large-scale data theft campaign by compromising OAuth tokens issued to the Salesloft Drift application, used to integrate Drift’s AI-enabled chat with Salesforce, and weaponizing these tokens to infiltrate numerous Salesforce instances. The attacker systematically exfiltrated high-value data from Salesforce objects such as Cases, Accounts, Users, and Opportunities. Their primary objective appears to have been harvesting credentials including AWS access keys, passwords, and Snowflake access tokens. After accessing the data, UNC6395 demonstrated operational security awareness by deleting query jobs to cover their tracks, although logs remained intact for post-incident analysis.

Additional reports from vendors confirmed that the incident had the characteristics of a supply chain compromise stemming from the Salesloft Drift integration. More than twenty organizations, including Google Workspace, Cloudflare, CyberArk, and Palo Alto Networks acknowledged some level of impact.