Google Threat Intelligence Group (GTIG) published a report in August 2025 revealing that threat actors used compromised OAuth tokens associated with Salesloft Drift to access Salesforce environments across multiple organizations [1]. The report stated that the activity occurred at least between August 8 and August 18, during which attackers exported large volumes of data and searched for credentials [1]. Salesloft and Salesforce subsequently revoked the Drift-related tokens and emphasized that the incident did not stem from a vulnerability in the core Salesforce platform [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on Aug 26, 2025 and we added it on Nov 10, 2026. It is not a new event.
CriticalMonitoringBackfillMedia reported
Google Threat Intelligence Discloses Theft of Salesforce Data via Compromised Salesloft Drift OAuth Tokens
1 min read
- Disclosed
- Aug 26, 2025
- Occurred
- Aug 8, 2025
- Published
- Nov 10, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- Our assessment
- Attack vector
- Impact
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Technology, Cross-industry
What to do nowOur advice
Salesloft and Salesforce subsequently revoked the Drift-related tokens and emphasized that the incident did not stem from a vulnerability in the core Salesforce platform [1].
Timeline
Technical details
Source-Supported Details
Organizations should review Salesforce and Drift integrations, revoke and rotate tokens, audit data export and query logs, and check whether cloud keys or other secrets were harvested [1].
Source excerpt: "Contact Mandiant Written by: Austin Larsen, Matt Lin, Tyler McLellan, Omar ElAhdan Update (August 28) Based on new information identified by GTIG, the scope of this compromise is not exclusive to the Salesforce integration with Salesloft Drift and impacts other integrations." [1].
References
Research1
- [1]
“Contact Mandiant Written by: Austin Larsen, Matt Lin, Tyler McLellan, Omar ElAhdan Update (August 28) Based on new information identified by GTIG, the scope of this compromise is not exclusive to the Salesforce integration with Salesloft Drift and impacts other integrations.”
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.