Data Theft Alert: Salesforce Instances Breached via Third-Party App OAuth Tokens

The Google Threat Intelligence Group (GTIG) has issued an urgent advisory attributing the campaign to UNC6395, which targeted Salesforce environments via compromised OAuth tokens linked to the Salesloft Drift third‑party application. According to GTIG, beginning as early as Aug 8, 2025 through at least Aug 18, 2025, the actor harvested credentials by systematically exporting data from Salesforce instances and exfiltrating secrets such as AWS keys, passwords, and Snowflake tokens.

The attackers used SOQL queries to pull large volumes of data from Accounts, Opportunities, Users and Cases, and were able to access detailed user information including IDs, usernames, emails, and login histories. On Aug 20, 2025, Salesloft, in coordination with Salesforce, revoked all active Drift-related tokens and Salesforce removed the Drift app from the AppExchange, with GTIG noting there is no evidence of a vulnerability within the core Salesforce platform.

GTIG emphasises organisations using Drift integrated with Salesforce should consider their data compromised and take immediate remediation steps, including log review, credential rotation, and tightening connected app access controls.