Google Threat Intelligence Group

Google Threat Intelligence Discloses Theft of Salesforce Data via Compromised Salesloft Drift OAuth Tokens

Google Threat Intelligence Group (GTIG) published a report in August 2025 revealing that threat actors used compromised OAuth tokens associated with Salesloft Drift to access Salesforce environments across multiple organizations .