Google Warns Salesloft OAuth Breach Extends Beyond Salesforce, Impacting All Integrations

According to Google Threat Intelligence Group (GTIG) and Mandiant, the recent wave of attacks targeting Salesforce instances via Salesloft Drift is much broader than initially thought, and now extends to all integrations. Google has advised all Salesloft Drift customers to treat any authentication tokens stored in or connected to the Drift platform as potentially compromised.

It said attackers also used stolen OAuth tokens to access email from a small number of Google Workspace accounts on 9 August 2025, after compromising the OAuth tokens for the “Drift Email” integration, though Google emphasised this is not a compromise of Google Workspace or Alphabet itself. The only accounts potentially accessed were those specifically configured to integrate with Salesloft, and the actor would not have been able to access other Workspace accounts.

Following the discovery, Google notified impacted users, revoked the Drift Email OAuth tokens, and disabled the integration between Google Workspace and Salesloft Drift during ongoing investigation. The advisory notes a broadening of the attack radius linked to a campaign that leveraged compromised OAuth tokens associated with Salesloft Drift to target Salesforce instances from 8 to 18 August 2025.