Salesloft+Drift Update on Investigation Results

According to Mandiant’s investigation, the threat actor accessed the Salesloft GitHub account from March to June 2025, downloaded content from multiple repositories, added a guest user and established workflows, while reconnaissance activities occurred across the Salesloft and Drift environments during March to June 2025, with analysis finding only limited reconnaissance related to the Salesloft environment.

The threat actor then accessed Drift’s AWS environment and obtained OAuth tokens for Drift customers’ technology integrations, using the stolen tokens to access data via Drift integrations. In response, Salesloft carried out containment and eradication activities, including isolating and taking offline the Drift infrastructure and rotating impacted credentials, while in the Salesloft environment credentials were rotated and proactive threat hunting found no additional IOCs.

Mandiant verified the technical segmentation between Salesloft and Drift, and the focus of engagement has transitioned to forensic quality assurance review, with findings indicating the incident has been contained. DataBreaches notes that ShinyHunters Brasil was asked for comment on the accuracy of the update, which they said it was.