Incident & Breach Response
,
Security Operations
‘Widespread Data Theft Campaign’ Compromised Many Drift OAuth Tokens, Warn Experts
Zero trust platform provider Zscaler is warning customers that hackers stole user data, including license information and details of some support cases.
See Also: On Demand | Global Incident Response Report 2025
The data breach traces to a much wider campaign involving attackers targeting marketing-as-a-service software provider Salesloft’s Drift artificial intelligence chat agent. Hackers are stealing OAuth access tokens to give them access to integrated applications. Many organizations, including Zscaler, integrate the Drift sales automation software with their Salesforce database to track and manage leads, including contact information.
Initial reports suggested this attack campaign only affected Salesforce instances integrated with Drift. Now, Google’s threat intelligence group is warning that the “widespread data theft campaign” potentially breached every other software application integrated with Drift Email.
“The scope of this compromise is not exclusive to the Salesforce integration with Salesloft Drift and impacts other integrations,” Google threat researchers reported Thursday. “We now advise all Salesloft Drift customers to treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised.”
Salesloft offers integrations to over 50 other tools besides Salesforce, including Eloqua, Facebook Analytics, Google Analytics, Marketo, Zapier and Zoom.
The breach victims include an as-yet-unknown number of victims, although Google has reportedly suggested that 700 organizations may have been affected.
“As part of this campaign, unauthorized actors gained access to Salesloft Drift credentials of its customers including Zscaler,” the company’s CISO, Sam Curry, said in a Saturday breach alert. “Following a detailed review as part of our ongoing investigation, we have determined that these credentials have allowed limited access to some Zscaler Salesforce information.”
The exposed information includes business contact details, including names, business email addresses, job titles, phone numbers, location details, Zscaler product and license details and text tied to some support cases.
“Please be wary of potential phishing attacks or social engineering attempts, which could leverage exposed contact details,” Curry said.
Following the breach discovery, Zscaler said it revoked all Drift access to Salesforce data, has rotated other API access tokens as well “out of an abundance of caution,” and launched an investigation into the incident, working closely with Salesforce, including to better understand the potential impact tied to other vendors used by Zscaler.
In addition, Zscaler’s customer support team has “further strengthened customer authentication protocol when responding to customer calls to safeguard against potential phishing attacks,” Curry said.
The full scope of the breach has yet to come to light publicly. Salesloft acquired Drift in February 2024. At that time, the combined company counted over 5,000 global customers, including Cisco, Google, IBM, Shopify, Square and 3M. How many of them use Drift, and have integrated it with other applications, isn’t clear.
Security experts said OAuth tokens are a high-value target for hackers, because of the persistent access they grant. “Unlike user sessions, OAuth tokens often don’t expire, creating long-term exposure in the event of an OAuth breach,” said SaaS security platform AppOmni.
Ongoing Investigation
Salesloft on Aug. 20 first warned customers that it was probing “a security incident,” and working with Google Cloud’s Mandiant incident response group and insurer Coalition to mitigate and respond to the attack.
The same day, working with Salesforce, Salesloft said it immediately revoked all access tokens for the Drift application, which will also require organizations that integrate Drift with Salesforce to reauthenticate that integration. Salesforce also temporarily removed Drift from its AppExchange cloud marketplace.
In an Aug. 26 update, Salesloft said the compromise of integrated Salesforce instances appeared to run from Aug. 8 to at least Aug. 18. “Initial findings have shown that the actor’s primary objective was to steal credentials, specifically focusing on sensitive information like AWS access keys, passwords and Snowflake-related access tokens,” it said.
“We are recommending that all Drift customers who manage their own Drift connections to third-party applications via API key, proactively revoke the existing key and reconnect using a new API key for these applications,” Salesforce said. “This only relates to API key-based Drift integrations. OAuth applications are being handled directly by Salesloft.”
On Thursday, Google’s Threat Intelligence Group reported that based on new information that came to light, the attacks by the threat actor, which it tracks as UNC6395, were much “broader” than just exfiltrating data from Salesforce software instances integrated with Drift.
“We have now identified that OAuth tokens for other Drift integrations were also compromised by the threat actor,” said Austin Larsen, a principal threat analyst at Google Threat Intelligence Group, in a Thursday post to LinkedIn.
“Organizations should look for suspicious activity with Drift integrations in any platform, not just Salesforce,” said Mandiant CTO Charles Carmakal, in a Thursday post to LinkedIn.
Google said the attacker breached Google Workspace instances for customers who integrated them with Drift. “Google identified the impacted users, revoked OAuth tokens granted to the Drift Email application and disabled the integration functionality between Google Workspace and Salesloft Drift pending further investigation,” Larsen said.
Attribution Unclear
Some security researchers have suggested that the group behind the attacks may be Chinese, apparently based in part on its focus on OAuth tokens and facility with running Salesforce Object Query Language queries.
The ShinyHunters extortion group initially claimed to BleepingComputer that they were behind the attacks, before retracting that statement. The group, which crosses over with Scattered Spider, has tricked numerous Salesforce-using organizations into giving them access to their customer data, which they then hold to ransom.
As yet, Google hasn’t attributed UNC6395 to any cybercrime group or nation-state. The UNC – for “uncategorized” – designation reflects an assessment that so far, whether the group’s goals hew more toward financial motivation or advanced persistent threat activity remains unclear.