Hackers Abuse Compromised OAuth Tokens to Access and Steal Salesforce Corporate Data

According to Google Threat Intelligence Group, an advisory described a data theft operation targeting corporate Salesforce instances via the Drift integration, with beginnings as early as 8 August 2025. The activity involved UNC6395 using valid access and refresh tokens tied to the Salesloft Drift app to authenticate as a connected app user and run large-scale SOQL queries to export records from Accounts, Opportunities, Users and Cases.

After exfiltration, the actor searched the stolen data for sensitive material such as AWS access keys, passwords and Snowflake tokens, while attempting to wipe query audit trails; however Salesforce event logs remained intact, enabling traceability for affected organisations. Salesloft clarified that only customers integrating with Salesforce via Drift were impacted, and Google Cloud customers without that integration faced no known exposure.

On 20 August 2025, Salesloft and Salesforce revoked all active Drift tokens and removed the application from AppExchange pending investigation, with a call for affected customers to rotate credentials, review event monitoring logs and harden connected app controls to limit exposure.