Zscaler, Palo Alto Networks Breached via Salesloft Drift

Two major security firms were affected through a large-scale supply chain attack involving Salesforce’s Salesloft Drift, with UNC6395 identified as the threat actor behind the campaign began early last month. From Aug. 8 to 18, a threat actor used OAuth credentials to exfiltrate data from customers’ Salesforce environments, and on Aug. 20 Salesloft disclosed the incident, with further details released six days later.

Zscaler and Palo Alto Networks were among the customers impacted, with Zscaler reporting that unauthorized actors gained access to Salesloft Drift credentials and that this allowed limited access to some Zscaler Salesforce information, including names, business email addresses, job titles, phone numbers, and certain product licensing data and support-case content.

For Palo Alto Networks, the disclosure said the incident affected hundreds of customers and that stolen data mainly consisted of business contact information, internal sales account data and basic case data, with the attacker’s access isolated to the CRM layer and the attacker reportedly contained. Unit 42 described mass exfiltration of Salesforce objects and signs of credential scanning after exfiltration.

According to Zscaler CISO Sam Curry, the company has found no evidence of misuse of the exposed information, and Palo Alto Networks added that the incident did not affect its products, systems or services. The disclosures come as Salesforce disabled all Salesloft integrations to Salesforce until further notice, and Google, which owns Mandiant, urged Drift customers to treat tokens as potentially compromised. The article was written by Alexander Culafi for Dark Reading on 2 September 2025.