Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks

Hackers breached the sales automation platform Salesloft to steal OAuth and refresh tokens from its Drift chat agent integration with Salesforce, enabling them to pivot to customer environments and exfiltrate data, according to Salesloft. The compromised SalesDrift integration connects Drift’s AI chat with a Salesforce instance to sync conversations, leads and support cases into the CRM.

Threat actors obtained the Drift OAuth and refresh tokens used for the Salesforce integration and used them to conduct a Salesforce data theft campaign between 8 August and 18 August 2025, Lawrence Abrams reports. Initial findings have shown that the actor’s primary objective was to steal credentials, specifically focusing on sensitive information like AWS access keys, passwords and Snowflake-related access tokens, reads a Salesloft advisory.

The attribution to ShinyHunters and Scattered Spider is presented as a claim by sources such as Dissent and corroborated by others, though the article notes that more evidence may be needed. Read more at Bleeping Computer.