Salesloft Drift Breach Rolls Up Cloudflare, Palo Alto, Zscaler, and Others

The Salesloft Drift breach has widened to include Cloudflare, Palto Alto Networks, and Zscaler, according to Dissent’s report dated 3 September 2025. The incident involves the UNC6395 threat group exploiting a vulnerability in Salesloft Drift OAuth integration with Salesforce to access Salesforce customers’ instances and steal sensitive information from reportedly hundreds of organisations.

According to the Google Threat Intelligence Group (GTIC), UNC6395 targeted Salesforce customers’ instances from August 8 through at least August 18 via compromised OAuth tokens associated with the Salesloft Drift app, which is used by sales and marketing teams to automate workflows. Security firms SpyCloud and PagerDuty also said they were hit by the same activity.

Cloudflare’s security executives noted in a blog post this week that bad actors accessed the company’s Salesforce instance used for customer support and case management.