Google: Salesforce Attacks Stemmed From Third-Party App

A threat group tracked as UNC6395 carried out a widespread data theft campaign against Salesforce instances by compromising OAuth tokens associated with the third‑party Salesloft Drift app, according to GTIG researchers via the Mandiant blog. The activity appears to have begun as early as 8 August and continued through at least 18 August.

UNC6395 reportedly exported large volumes of data from numerous Salesforce instances to harvest credentials such as AWS access keys (AKIA), passwords, and Snowflake-related tokens, and then searched for secrets to potentially compromise victim environments before deleting query jobs to cover their tracks.

The remediation guidance notes that the campaign is limited to Salesloft customers using the Drift integration with Salesforce, and there is no evidence that Google Cloud customers were breached, though organisations using Drift with Salesforce should review their Salesforce objects for any Google Cloud Platform service account keys.

Salesforce and Salesloft worked with GTIG to revoke all active access and refresh tokens for Drift, and the Drift application was removed from the Salesforce AppExchange until further notice and investigation. In addition, Google urged organisations to rotate credentials, review logs and Salesforce monitoring data, and harden access controls to limit permissions and enforce IP restrictions.