UNC6395 targets Salesloft in Drift OAuth token theft campaign

According to Google Threat Intelligence Group and Mandiant, UNC6395 carried out a data theft campaign aimed at the Salesloft platform to steal OAuth and refresh tokens associated with the Drift AI chat agent, with exfiltration from Salesforce instances between 8 August 2025 and 18 August 2025.

The operation reportedly allowed the threat actor to harvest credentials such as AWS access keys (AKIA) and Snowflake tokens, prompting Salesforce and Salesloft to revoke tokens and suspend the Drift–Salesforce connections on 20 August 2025. The organisations were urged to review logs, revoke keys, rotate credentials, and investigate potential abuse of secrets within Salesforce objects; Salesloft stated that the incident did not affect customers not using the Drift–Salesforce integration.

The threat actor is described as having deleted query jobs to evade detection, and Salesforce said a small number of customers were affected. A DFIR firm is assisting the investigation, and Salesloft has shared indicators of compromise while indicating there is no evidence of ongoing malicious activity.