Salesloft OAuth Breach via Drift AI Chat Agent Exposes Salesforce Customer Data

The Hacker News reports a widespread data theft campaign that breached Salesloft to steal OAuth and refresh tokens tied to the Drift AI chat agent, with the intrusions attributed to a threat actor tracked as UNC6395 by Google Threat Intelligence Group and Mandiant. Beginning as early as 8 August 2025 and continuing through at least 18 August 2025, the attackers targeted Salesforce customer instances using compromised OAuth tokens associated with the Salesloft Drift third‑party application.

Researchers note that the actors exported large volumes of data from numerous Salesforce instances, including AWS access keys, passwords, and Snowflake tokens, in what appears to be an effort to harvest credentials for further compromise.

Salesloft said in an advisory issued on 20 August 2025 that it identified a security issue in the Drift application, proactively revoked connections between Drift and Salesforce, and notified affected customers; Salesforce later stated a small number of customers were impacted and that Drift’s access had been removed from AppExchange. Administrators are being urged to re‑authenticate their Salesforce connection to re‑enable the integration, while the exact scale of the activity remains unknown.