Stolen OAuth tokens from the Salesloft Drift integration are used to export data from customers' Salesforce instances (2025)
From as early as August 8 to at least August 18, 2025, an actor tracked as UNC6395 used compromised OAuth tokens of the Salesloft Drift third-party application to access customers' Salesforce instances.
What happened
- The actor systematically exported large volumes of data from numerous corporate Salesforce instances, with the apparent primary aim of harvesting credentials contained in that data.Widespread Data Theft Targets Salesforce Instances via Salesloft Drift
- GTIG later confirmed that OAuth tokens for the "Drift Email" integration were also compromised and used to read email in a small number of Google Workspace accounts configured to integrate with Drift.Widespread Data Theft Targets Salesforce Instances via Salesloft Drift
The failure pattern
Watch the pattern: Weak or phishable authentication on a privileged path
Safeguards that address it
CollectSEA's engineering analysis of what would have prevented or contained this failure.
- Scope and expire third-party integration tokensGrant integrations the narrowest data access they need, rotate their tokens, and revoke them quickly when the vendor reports a compromise.
- Monitor integrations for bulk exportAlert on unusually large queries or exports performed through a connected app's credentials.
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
- ASI03 Identity and Privilege Abuse
- LLM03 Excessive Agency
- AC-3 Access Enforcement
- AC-5 Separation of Duties
- AC-6 Least Privilege
- IA-2 Identification and Authentication
- RV.3.4 Update the development process
- MAP 5.1 Estimate impacts from past uses and public incident reports
- Goal 1 Multi-factor authentication
- Goal 2 Default passwords
- CWE-862 Missing Authorization
- CWE-308 Use of Single-factor Authentication
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
Self-replicating "Shai-Hulud" worm compromises more than 500 npm packages by stealing developer tokens (2025)
CISA reported that a self-replicating worm known as "Shai-Hulud" had compromised more than 500 npm packages.
Malicious code committed to the Amazon Q Developer VS Code extension via a compromised token (AWS, 2025)
Malicious code was committed to the extension's open-source repository using a compromised GitHub token in a build configuration.
Call and text records of nearly all AT&T wireless customers taken from a third-party cloud workspace (2024)
Contractor credentials without MFA accessed third-party cloud data warehouse; downloaded 109 million customer call and text records.
Stolen credentials on a remote-access portal lead to the Change Healthcare ransomware outage (2024)
Single-factor remote access portal breached with stolen credentials; ransomware forced nationwide claims gateway disconnection.
Password spray on a legacy test tenant exposes Microsoft corporate email to a nation-state actor (2024)
Legacy test tenant without MFA compromised via password spraying; adversary created malicious OAuth apps with mail.read privileges.
Stolen credential opens Okta's support system, where uploaded HAR files held customer session tokens (2023)
Support portal allowed unredacted HAR file uploads containing session tokens; threat actor hijacked customer administrator accounts.