A recent supply-chain attack targeting Salesloft – the provider of a popular AI chatbot integrated with Salesforce – has compromised data from hundreds of companies. Tracked by Google as threat group UNC6395, the attackers stole OAuth access tokens for Salesloft’s Drift chatbot integration and used them between August 8 and August 18, 2025 to illicitly access the Salesforce records of many Salesloft customers. Salesloft’s Drift agent is used by over 5,000 organizations to capture website chat interactions and feed them into Salesforce as sales leads. By breaching this third-party service, the hackers effectively gained limited but unauthorized entry into numerous corporate Salesforce databases – over 700 companies are believed to be impacted – without exploiting any vulnerability in Salesforce itself.
This incident goes far beyond just Salesforce data. Google’s Threat Intelligence Group revealed on August 26 that the perpetrators siphoned large amounts of information and also stole valid authentication tokens for hundreds of other services integrated with Salesloft. Stolen tokens included those for Slack, Google Workspace (Gmail accounts), Amazon S3 storage buckets, Microsoft Azure resources, OpenAI integrations, and more. For instance, on August 9 the attackers leveraged tokens from Salesloft’s Drift Email integration to read emails from a small number of Google Workspace mailboxes tied to Salesloft. These findings underscore that any service connected to a compromised Salesloft instance could be at risk, not just Salesforce.
Several major companies have already acknowledged that their Salesforce data was accessed via the Salesloft breach. Notably, Zscaler, Palo Alto Networks, PagerDuty, Tanium, and SpyCloud confirmed unauthorized access to their Salesforce customer relationship management (CRM) data through this incident. In all cases, the access was reportedly limited to Salesforce databases and did not extend into other internal systems or infrastructure. However, the exposed customer and business data can be leveraged by threat actors for follow-on attacks.
Victim companies have warned that clients and contacts might face highly convincing phishing or social engineering scams in the wake of this breach. Even more concerning, Google analysts observed that the attackers were primarily hunting for sensitive credentials within the troves of data they stole – specifically looking for AWS access keys, VPN logins, and Snowflake data warehouse tokens. Any such credentials found could enable the adversaries to further infiltrate the victims’ cloud infrastructure or pivot into partner and client environments.
Key containment and response measures:
- Salesforce.com: On August 28, Salesforce (the CRM provider) proactively disabled all integrations with Salesloft technology – including the Drift app, Slack, and Pardot integrations – to safeguard customer environments. This temporary shutdown of connectivity is intended to prevent further unauthorized access while the situation is assessed.
- Google: Google has likewise disabled Salesloft’s Drift integration with Google Workspace pending investigation. Google’s security team is urging any organizations using Salesloft to invalidate all tokens/credentials associated with Salesloft integrations and replace them with new ones. They also advise thoroughly reviewing all systems connected to Salesloft (Salesforce, email, cloud storage, etc.) for signs of unauthorized access or suspicious activity.
- Salesloft: The company has enlisted cybersecurity firms Mandiant (Google Cloud) and Coalition to investigate the root cause of the token compromise. Salesloft’s advisory to customers on August 27 recommended that those managing Drift integrations via API keys should proactively revoke and regenerate their API keys, as an added precaution. So far, Salesloft has not disclosed how the hackers initially obtained the OAuth tokens, and the exact origin of the breach remains under investigation.
The threat actor attribution for this supply-chain breach remains unclear. A Telegram channel dubbed “Scattered LAPSUS$ Hunters 4.0” has claimed responsibility for the Salesloft hack, associating itself with the notorious ShinyHunters and LAPSUS$ groups. However, Google’s analysts have found no compelling evidence linking this campaign to any known threat group at this time. In the absence of a confirmed culprit, the identifier UNC6395 is used to track the activity.
This incident highlights the growing risk of trust in third-party integrations and authentication tokens. Cybersecurity experts note that the attackers exploited legitimate access tokens to move laterally through victim systems, an approach sometimes referred to as “authorization sprawl.” By abusing valid credentials and single sign-on connections, attackers can blend in with normal usage – making intrusions harder to detect compared to traditional malware-based attacks. The Salesloft breach is a stark reminder of the need for vigilant oversight of SaaS integrations and prompt rotation of credentials when any part of the software supply chain is compromised.
Enjoy !
Sources
Help Net Security : https://www.helpnetsecurity.com/2025/09/02/zscaler-palo-alto-networks-spycloud-among-the-affected-by-salesloft-breach/
KrebsOnSecurity : https://krebsonsecurity.com/2025/09/the-ongoing-fallout-from-a-breach-at-ai-chatbot-maker-salesloft/
