Hackers breached Salesloft ’s GitHub in March, and used stole tokens in a mass attack

Hackers breached Salesloft’s GitHub account in March, stealing authentication tokens that were later used in a mass attack against several major tech customers. According to the investigation, the threat actor UNC6395 carried out reconnaissance in Salesloft and Drift environments from March 2025 to June 2025, with access to Salesloft’s GitHub lasting from March to June 2025, during which content was downloaded, a guest user was added, and workflows were established.

The intruders also breached Drift’s AWS environment, obtaining OAuth tokens for Drift customers’ technology integrations, which were then used to access data via Drift integrations; Salesloft says the incident is now contained. Mandiant’s findings note limited reconnaissance within the Salesloft environment and detail the six-month delay in detection, prompting Salesloft to isolate Drift’s infrastructure, rotate credentials, and revoke Drift API keys. Salesforce restored integrations with Salesloft on 7 September 2025 but kept Drift disabled until further notice as part of the ongoing response.