Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks

Hackers breached Salesloft to steal OAuth and refresh tokens from its Drift chat agent integration with Salesforce, enabling a Salesforce data-theft campaign aimed at exfiltrating customer information. The ShinyHunters extortion group claims responsibility for these Salesforce attacks, with threat activity spanning from 8 August to 18 August 2025.

Googleundefineds Threat Intelligence team (Mandiant) is tracking the actor as UNC6395, noting that once inside a Salesforce instance the group issued SOQL queries to harvest case authentication tokens, passwords, and secrets from support cases.

According to Salesloft advisory, the primary objective included stealing credentials such as AWS access keys, passwords, and Snowflake-related tokens, and the incident did not appear to impact customers not using the Drift-Salesforce integration; authorities also state there was no evidence of ongoing malicious activity.

In response, Salesloft, in coordination with Salesforce, revoked all active access and refresh tokens for the Drift application, requiring customers to re-authenticate, and admins are advised to disconnect and then reconnect the Salesforce integration with valid credentials.