Case salesloft-drift-oauthAI supply chainWorldwide
Drift AI chatbot OAuth tokens stolen to raid 700+ Salesforce tenants
UNC6395 used OAuth tokens stolen from the Drift AI chat integration to bulk-export Salesforce data from hundreds of organizations and hunt for cloud keys and passwords.
CriticalAttack on AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 26, 2025
- Location
- Worldwide
- Target
- Salesloft Drift / Salesforce customers
- Severity
- Critical
- Triggered by
- UNC6395 (unknown financially motivated group)
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
UNC6395 used OAuth tokens stolen from the Drift AI chat integration to bulk-export Salesforce data from hundreds of organizations and hunt for cloud keys and passwords.
Impact: Over 700 organisations' Salesforce data exported, including support cases containing AWS keys, Snowflake tokens and passwords; downstream disclosures from Cloudflare, Zscaler, Palo Alto Networks, Google and others
Who triggered it
Actor: UNC6395 (unknown financially motivated group)
Attribution: Tracked as UNC6395 by Google Threat Intelligence Group and Mandiant; a group claiming ties to ShinyHunters also claimed responsibility, unconfirmed
Motive: Credential harvesting (AWS keys, Snowflake tokens, passwords) from CRM data for follow-on intrusions and extortion
How it happened
Attack vector: Stolen OAuth and refresh tokens for the Salesloft Drift Salesforce integration used to run SOQL queries and bulk-export Account, Case, Opportunity and User objects
Root cause: Compromise of Salesloft's GitHub and Drift AWS environment exposed long-lived OAuth tokens for a widely trusted third-party app with broad Salesforce data scope
Timeline
- Per Mandiant, actor gains access to Salesloft's GitHub account (March to June) and later Drift's AWS environment
- Mass Salesforce data exfiltration via Drift OAuth tokens begins, continuing through at least August 18
- Salesforce and Salesloft revoke all Drift tokens and remove Drift from AppExchange
- Google Threat Intelligence Group publishes UNC6395 advisory; Drift Email tokens also found abused against Google Workspace
Response
Tokens revoked, Drift integration disabled and later taken offline, Mandiant engaged, customers told to rotate exposed secrets; FBI issued a FLASH alert
Current status: Contained
Sources (open in a new tab)
- Security Affairs securityaffairs.com
- Google Cloud Threat Intelligence cloud.google.com
- Help Net Security helpnetsecurity.com
Cite this case
Drift AI chatbot OAuth tokens stolen to raid 700+ Salesforce tenants. AI Threat Watch, case salesloft-drift-oauth, Aug 26, 2025. https://aithreat.io/cases/salesloft-drift-oauth/
Permanent link: https://aithreat.io/cases/salesloft-drift-oauth/