Threat Brief: Salesloft Drift Integration Used To Compromise Salesforce Instances

Threat researchers report activity consistent with a threat actor campaign that leveraged the Salesloft Drift integration to compromise customer Salesforce instances. According to Salesloft, from 8 to 18 August 2025 a threat actor used compromised OAuth credentials to exfiltrate data from affected Salesforce environments.

The actor conducted mass exfiltration of data from Account, Contact, Case and Opportunity records and appears to have scanned the acquired data for credentials to enable further access, while deleting queries to obscure evidence of the jobs run. Salesloft has confirmed that all impacted customers were notified and that it proactively revoked all active access and refresh tokens for the Drift application, requiring re-authentication for affected administrators.

Palo Alto Networks and Unit 42 advise organisations to monitor Salesforce and Salesloft updates and to follow the recommendations outlined for immediate investigation, credential rotation and proactive threat hunting.