Salesloft Drift OAuth tokens used to raid Salesforce tenants
From as early as August 8 through at least August 18, 2025, UNC6395 used compromised OAuth tokens for the Salesloft Drift third-party app to query and export data from numerous corporate Salesforce instances, then searched the data for AWS access keys, passwords and Snowflake tokens. Salesloft and Salesforce revoked all Drift access and refresh tokens on August 20. Google later reported that Drift Email tokens were also used on August 9 to read mail from a very small number of Google Workspace accounts.
- Victim
- Multiple: Salesforce customers using the Salesloft Drift integration, including Cloudflare
- Industry
- B2B SaaS
- Country
- Global
- Intrusion began
- Aug 8, 2025
- First disclosed
- Aug 20, 2025
- Actor
- UNC6395 (Google Threat Intelligence) (Unattributed)
- Initial access
- OAuth token abuse
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A third-party integration's refresh tokens worked as standing access to hundreds of tenants with no user or MFA in the path. Inventorying connected apps, scoping and IP-restricting their tokens, and keeping secrets out of CRM records limit what one vendor breach can reach.
Go deeper on SWI
- Technique: Refresh token abuse
Sources
- Widespread Data Theft Targets Salesforce Instances via Salesloft Drift, Google Threat Intelligence Group, Aug 26, 2025
- The impact of the Salesloft Drift breach on Cloudflare and our customers, Cloudflare, Sep 2, 2025
- Google Warns Salesloft Drift Breach Impacts All Drift Integrations Beyond Salesforce, The Hacker News, Aug 29, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Gainsight-published Salesforce app tokens abused against customer instances 2025 · OAuth token abuse
- GitHub private repositories accessed with stolen Heroku and Travis CI OAuth tokens 2022 · OAuth token abuse
- Malwarebytes email access via abused Microsoft 365 application 2021 · OAuth token abuse
- CrowdSec private repositories copied with a departing engineer's GitHub token 2026 · OAuth token abuse
Cite this record
SWI Community Team. (2026). Salesloft Drift OAuth tokens used to raid Salesforce tenants. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-salesloft-drift-oauth-token-theft/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.