Salesloft Takes Drift Offline After OAuth Token Theft Hits Hundreds of Organizations

Salesloft said it would take Drift offline temporarily “in the very near future” after a wide-reaching supply chain attack that has led to mass theft of authentication tokens. The incident, which began to be exploited as early as 8 August 2025 and continued through at least 18 August 2025, used stolen OAuth and refresh tokens tied to the Drift AI chat agent to breach Salesforce customer instances, according to Google Threat Intelligence Group and Mandiant.

The activity has been attributed to a threat cluster dubbed UNC6395 (also known as GRUB1), with Google telling The Hacker News that more than 700 organisations may have been impacted. Salesforce has temporarily disabled all Salesloft integrations with Salesforce as a precautionary measure, while Cloudflare, Google Workspace, PagerDuty, Palo Alto Networks, SpyCloud, Tanium and Zscaler have been named among those affected.

The company emphasised that safeguarding the integrity and security of customer data is a top priority and is working with Mandiant and Coalition as part of its incident response.