OAuth Compromise via Salesloft Drift Exposed New Salesforce Data

A major security incident has spotlighted the hidden dangers hiding within seemingly helpful AI tools. Cybercriminals exploited OAuth tokens from the Salesloft Drift AI chatbot to infiltrate Salesforce accounts—exfiltrating sensitive company data and even credentials from impacted environments. Here’s what happened, why it matters, and how organizations can safeguard against such silent threats.

The Incident in Full

How the Breach Happened
Attackers exploited OAuth tokens linked to the Salesloft Drift AI chat agent. These tokens granted access to numerous Salesforce accounts, allowing the attackers to query and download large volumes of data using SOQL. A secondary objective appeared to be harvesting AWS keys, passwords, and Snowflake tokens stored within the Salesforce data.
Attacker Behavior and Methodology
The group, tracked as UNC6395, targeted Salesforce organizations through impersonating trusted OAuth integrations. Once access was obtained, they disguised their activities using Tor and cloud IPs and erased query history—making detection more challenging.
Timeline and Containment
The data theft occurred between August 8 and August 18. Salesloft detected the breach on August 20, subsequently notifying affected clients, revoking tokens, and removing the vulnerable Drift integration from the AppExchange.

What Makes This Breach Noteworthy

OAuth Overreach
OAuth’s power lies in delegated access, but its misuse—especially by deeply integrated services like chatbots—can make breaches seamless and destructive.
Third-Party Tools as Attack Vectors
Drift, when linked to Salesforce via Salesloft, acted as an unassuming door for attackers. This underscores how integrations, especially AI-driven ones, amplify security risk.
Not Just Data—Credentials Stolen Too
Beyond customer data, the attackers sought infrastructure credentials—expanding their reach into victim organizations beyond Salesforce.

FAQs: What You Need to Know

Q	A
How did the attackers get in?	By abusing OAuth tokens from Salesloft Drift to impersonate trusted access points in Salesforce.
Why are OAuth tokens so risky?	They’re like keys to your data—they offer access without user credentials and can easily be stolen or misused.
What systems were affected?	Salesforce environments connected via Salesloft + Drift were exposed, especially data tied to cases, opportunities, accounts, and users.
What actionable data was a target?	CRM data plus AWS keys, Snowflake tokens, and other credentials stored in Salesforce.
How can organizations defend themselves?	Audit connected apps, restrict OAuth access to essential roles, monitor logs, and revoke unverified or dormant tokens quickly.

Takeaway

In a world enamored with AI convenience—from chatbots to sales tools—security can fall by the wayside. This breach is a sobering reminder that even trusted integrations can backfire if OAuth permissions go unchecked. Regular audits, strict token policies, and monitoring for unusual queries are more than smart practices—they’re survival strategies in the AI age.