Security brief
Stolen Drift OAuth tokens enabled Salesforce data theft in August 2025
REVIEWGoogle’s investigation tied the campaign to compromised integration tokens, highlighting the reach of third-party SaaS access.
What happened
Google Threat Intelligence reported that UNC6395 used compromised Salesloft Drift OAuth tokens to access Salesforce customer instances between August 8 and 18, 2025. The attackers exported data and searched for credentials and other valuable information.
The investigation expanded beyond Salesforce to other Drift integrations. Google distinguished affected Drift Email integrations from a breach of Google Workspace itself; the report does not support treating every connected vendor as compromised.
Organizations that used the affected integrations should follow incident-specific vendor guidance, revoke affected access, rotate exposed credentials and review integration activity. This is a historical incident brief, not a claim that every present-day Drift deployment remains compromised.
Next step
Review vendor incident guidance, integration grants and historical access logs.
What we know
- Observed activity
- August 8–18, 2025, according to Google Threat Intelligence.
What remains unknown
- Open question
- The sources reviewed do not establish whether your deployment was exploited.
Source references
-
CLO