Unpacking the Salesloft incident: Insights from Darktrace

Darktrace notes a supply chain-style data theft campaign in August 2025 that targeted Salesloft via compromised Drift-enabled OAuth tokens and Salesforce integrations, with the incident attributed to the threat actor UNC6395.

The attack is understood to have begun in early August and continued through mid-August, during which attackers exfiltrated significant volumes of data from multiple Salesforce instances and harvested credentials found in the retrieved data, according to Mandiant and Google Threat Intelligence Group.

Initial access was gained by abusing Drift OAuth and refresh tokens, with researchers also detecting use of the Secrets scanner TruffleHog and unusual IAM updates to ensure persistence, and at least one new user account was created in early September.

Darktrace observed two US-based customer cases involving Drift-linked Salesforce activity, including a suspicious login from the rare IP 208.68.36[.]90 and a subsequent series of Salesforce API requests, with Autonomous Response prompting a potential disablement action that required manual confirmation.

The response by Salesforce and Salesloft to revoke the Drift-related OAuth tokens on 20 August aimed to cut off the attackers’ primary access channel, while the piece stresses the growing importance of autonomous, anomaly-based monitoring in SaaS environments, per CAF v4.0 guidance, according to Google Threat Intelligence Group.