Salesloft GitHub Account Compromised Months Before Salesforce Attack

According to Mandiant, the investigation into the incident found that the threat actor accessed the Salesloft GitHub account from March to June 2025, enabling them to download content from multiple repositories, add a guest user and establish workflows. The data breach itself occurred between 8 August and 18 August, with attackers using compromised OAuth tokens tied to Drift’s AI chatbot to export large volumes of data from Salesforce environments.

The campaign, attributed to a threat actor tracked as UNC6395, targeted hundreds of organisations and focused on extracting AWS access keys, passwords and Snowflake-related access tokens from the stolen data. SecurityWeek notes that the attackers’ activities were part of reconnaissance for a broader Salesforce–Salesloft data theft campaign, and that the incident led Salesforce to disable the Salesloft integration and briefly take Drift offline until security was restored.

Previous estimations suggested roughly 700 companies might have been affected, with subsequent reports expanding the list of impacted cybersecurity firms to include BeyondTrust, Bugcrowd, CyberArk, Cato Networks, JFrog, PagerDuty and Rubrik.