CriticalSupply chainMonitoringBackfillMedia reported· updated Nov 7
Google Threat Intelligence Group (GTIG) published a report in August 2025 revealing that threat actors used compromised OAuth tokens associated with Salesloft Drift to access Salesforce environments across multiple organizations .