Loading story…
Threat actors attributed as UNC6395 used compromised OAuth tokens tied to the Salesloft Drift integration to access numerous customer Salesforce instances and systematically exfiltrate sensitive records, including Account, Contact, Case, and Opportunity data. The activity ran from at least August 8 to August 18, 2025, with investigators reporting that the attackers issued large volumes of Salesforce API requests, exported data in bulk, and in some cases deleted query jobs or queries to hinder detection. Google Threat Intelligence Group and Palo Alto Networks Unit 42 said the campaign was aimed not only at data theft but also at credential harvesting, with the stolen Salesforce data searched for secrets such as AWS access keys, passwords, tokens, and Snowflake-related credentials that could support follow-on compromise.
Salesloft said it notified affected customers, while Salesloft and Salesforce revoked active Drift application access and refresh tokens on August 20, 2025 and removed the Drift app from the Salesforce AppExchange during the investigation. Researchers emphasized that the incident did not stem from a flaw in the core Salesforce platform, but from abuse of third-party integration tokens in a broader SaaS supply-chain intrusion. Additional reporting said suspicious activity included logins from 208.68.36[.]90, anomalous Salesforce API GET, POST, and DELETE requests, use of the user agent Python/3.11 aiohttp/3.12.15, and at least one case where a new user account was created for persistence; defenders were urged to review Salesforce, identity, and network logs and rotate any credentials exposed in the stolen data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2025-08-20, Salesloft and Salesforce responded by revoking all active Drift application access and refresh tokens; Salesforce also removed the Drift app from AppExchange pending investigation. Impacted organizations were notified as part of the containment effort.
The documented intrusion window ran through at least 2025-08-18, during which the actor systematically exported Salesforce data, searched it for credentials and secrets, and in some cases deleted query activity to hinder detection.
From as early as 2025-08-08, the threat actor UNC6395 used compromised OAuth tokens tied to the Salesloft Drift integration to access numerous Salesforce customer environments and begin large-scale data theft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
blog.alphahunt.io
Open sourcecloudsecurityalliance.org
Open sourceunit42.paloaltonetworks.com
Open sourcecloud.google.com
Open sourcetrust.salesloft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.