Salesloft Breached via GitHub Account Compromise

The breach began when a threat actor compromised Salesloft’s GitHub account earlier this year, triggering a massive supply chain attack that led to the compromise of hundreds of Salesforce instances via stolen OAuth tokens. The actor, tracked as UNC6395, used stolen tokens from Salesloft’s Drift application to access Drift’s AWS environment and steal tokens for Drift customers’ integrations, not just Salesforce.

According to the update, Mandiant determined the initial attack began as early as March and involved a compromised GitHub account. UNC6395 downloaded data from multiple Salesloft repositories and conducted reconnaissance in the Salesloft and Drift environments between March and June.

In late August, Google Threat Intelligence Group said UNC6395’s abuse of the tokens was not limited to Salesforce and urged all Drift customers to treat authentication tokens stored in or connected to the Drift platform as potentially compromised. It remains unclear how Salesloft’s GitHub account was initially compromised. Salesforce had disabled all integrations with Salesloft; a separate update later stated that the integration between Salesloft and Salesforce had resumed, with Drift remaining disabled for now.