The cyber incident at **Salesloft** involved the mass theft of authentication tokens from its **Drift AI chatbot platform**, which is widely used by corporate clients to integrate with Salesforce and other third-party services (e.g., Slack, Google Workspace, Amazon S3, Microsoft Azure, OpenAI). Hackers (tracked as **UNC6395**) exploited these stolen tokens to exfiltrate large volumes of data from corporate Salesforce instances between **August 8–18, 2025**, including AWS keys, VPN credentials, and Snowflake cloud storage access. Google’s Threat Intelligence Group (GTIG) confirmed the breach extended beyond Salesforce, compromising a small number of Google Workspace accounts linked to Salesloft. The attackers targeted credential materials to pivot into victim and partner environments, posing risks of further compromise. Salesforce subsequently blocked Drift integrations with its platform, Slack, and Pardot. The incident follows a broader social engineering campaign (linked to groups like **ShinyHunters** and **Scattered Spider**) using voice phishing to trick targets into authorizing malicious apps. While the root cause remains under investigation by **Mandiant**, the breach highlights risks of **authorization sprawl**, where attackers abuse legitimate access tokens to move undetected across cloud and on-premises systems.
Source: https://krebsonsecurity.com/2025/09/the-ongoing-fallout-from-a-breach-at-ai-chatbot-maker-salesloft/
TPRM report: https://www.rankiteo.com/company/drift
"id": "dri234090325",
"linkid": "drift",
"type": "Breach",
"date": "8/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Hundreds of Corporate Clients '
'(Exact Number Undisclosed)',
'industry': 'Sales Engagement/CRM',
'location': 'Atlanta, Georgia, USA',
'name': 'Salesloft',
'type': 'SaaS Provider'},
{'industry': 'Internet Services',
'location': 'Global',
'name': 'Google (Corporate Salesforce Instance)',
'type': 'Technology'},
{'industry': 'Apparel',
'location': 'Global',
'name': 'Adidas (Related Social Engineering Campaign)',
'type': 'Retail'},
{'industry': 'Insurance',
'location': 'USA',
'name': 'Allianz Life (Related Social Engineering '
'Campaign)',
'type': 'Financial Services'},
{'industry': 'Airline',
'location': 'Australia',
'name': 'Qantas (Related Social Engineering Campaign)',
'type': 'Aviation'}],
'attack_vector': ['Stolen Authentication Tokens',
'Authorization Sprawl',
'Social Engineering (Voice Phishing in Related Campaigns)'],
'customer_advisories': ['Re-authenticate Salesforce-Drift connections',
'Invalidate all Salesloft-integrated tokens'],
'data_breach': {'data_exfiltration': True,
'personally_identifiable_information': ['Potential (via '
'Compromised '
'Systems)'],
'sensitivity_of_data': 'High (Credentials, Corporate Data, '
'PII Risk via Lateral Movement)',
'type_of_data_compromised': ['Authentication Tokens',
'Cloud Credentials (AWS, '
'Snowflake)',
'Corporate Salesforce Data',
'Google Workspace Emails '
'(Limited)']},
'date_detected': '2025-08-20',
'date_publicly_disclosed': '2025-08-20',
'description': 'The recent mass-theft of authentication tokens from '
'Salesloft, whose AI chatbot (powered by Drift) is used by '
'corporate America to convert customer interactions into '
'Salesforce leads, has exposed hundreds of integrated online '
'services (e.g., Slack, Google Workspace, Amazon S3, Microsoft '
'Azure, OpenAI). Unidentified hackers (tracked as UNC6395) '
'exploited these tokens to siphon data from corporate '
'Salesforce instances, including AWS keys, VPN credentials, '
"and Snowflake access. Google's Threat Intelligence Group "
'(GTIG) warned of potential escalation to victim '
'clients/partners. The incident, detected on August 20, 2025, '
'involved data theft from August 8–18, 2025, with no '
'Salesforce platform vulnerability. Salesforce blocked Drift '
'integrations on August 28. The attack is linked to broader '
'social engineering campaigns targeting Salesforce, with '
'possible ties to threat groups like ShinyHunters and '
'Scattered Spider, though attribution remains unclear. '
'Mandiant is investigating the root cause.',
'impact': {'brand_reputation_impact': ['High (Due to Broad Corporate '
'Exposure)',
'Media Scrutiny Over Delayed '
'Disclosure of Token Theft Scope'],
'data_compromised': ['Salesforce Instance Data',
'AWS Keys',
'VPN Credentials',
'Snowflake Access Credentials',
'Google Workspace Emails (Limited)',
'Third-Party Integration Tokens (Slack, '
'Amazon S3, Microsoft Azure, OpenAI)'],
'identity_theft_risk': ['High (Due to Compromised Credentials)'],
'operational_impact': ['Urgent Token Invalidation Required',
'Integration Disruptions '
'(Salesforce/Slack/Pardot Blocked)',
'Potential Lateral Movement to '
'Client/Partner Environments'],
'systems_affected': ['Salesloft Drift Application',
'Salesforce Instances',
'Google Workspace (Limited Accounts)',
'Slack (Integration Blocked)',
'Pardot (Integration Blocked)']},
'initial_access_broker': {'entry_point': 'Salesloft Drift Application (Token '
'Theft Mechanism Unclear)',
'high_value_targets': ['Salesforce Instances',
'Google Workspace',
'AWS/Snowflake Credentials']},
'investigation_status': 'Ongoing (Mandiant Leading Root Cause Analysis)',
'lessons_learned': ['Authorization sprawl enables seamless lateral movement '
'using legitimate tokens.',
'Centralized identity platforms (SSO) are high-value '
'targets for credential theft.',
'Delayed disclosure of breach scope can exacerbate '
'operational and reputational risks.',
'Third-party integrations (e.g., Salesloft-Drift) '
'introduce systemic risk if compromised.'],
'motivation': ['Data Theft',
'Extortion',
'Credential Harvesting for Lateral Movement'],
'post_incident_analysis': {'corrective_actions': ['Pending'],
'root_causes': ['Pending Mandiant Investigation '
'(Potential: Insecure Token '
'Storage, Over-Permissioned '
'Integrations, Social '
'Engineering)']},
'ransomware': {'data_exfiltration': True},
'recommendations': ['Invalidate all tokens connected to Salesloft '
'integrations immediately.',
'Audit and restrict third-party app permissions in '
'Salesforce/SSO environments.',
'Monitor for unauthorized access to cloud services (AWS, '
'Snowflake, Google Workspace).',
'Implement behavioral analytics to detect anomalous token '
'usage.',
'Conduct tabletop exercises for credential-theft '
'scenarios involving SaaS integrations.'],
'references': [{'source': 'KrebsOnSecurity',
'url': 'https://krebsonsecurity.com'},
{'source': 'Bleeping Computer',
'url': 'https://www.bleepingcomputer.com'},
{'source': 'Cyberscoop', 'url': 'https://www.cyberscoop.com'},
{'date_accessed': '2025-08-26/2025-08-28',
'source': 'Google Threat Intelligence Group (GTIG) Advisory'},
{'date_accessed': '2025-08-20',
'source': 'Salesloft Security Alert'}],
'response': {'communication_strategy': ['Public Disclosure (August 20, 26, '
'28)',
'GTIG Advisories',
'Media Statements'],
'containment_measures': ['Blocking Drift Integrations '
'(Salesforce/Slack/Pardot)',
'Urgent Advisory to Invalidate All '
'Salesloft-Related Tokens'],
'incident_response_plan_activated': True,
'remediation_measures': ['Token Re-authentication for '
'Salesforce-Drift Connection',
'Investigation by Mandiant for Root '
'Cause'],
'third_party_assistance': ['Mandiant (Google Cloud)',
'Google Threat Intelligence Group '
'(GTIG)']},
'stakeholder_advisories': ['GTIG Urgent Advisory (August 26, 28)',
'Salesloft Customer Notification (August 20, 27)'],
'threat_actor': ['UNC6395', 'UNC6040 (Possibly Linked to ShinyHunters)'],
'title': 'Mass-Theft of Authentication Tokens from Salesloft Affecting '
'Multiple Corporate Integrations',
'type': ['Data Breach',
'Credential Theft',
'Unauthorized Access',
'Social Engineering']}