{"id":125841,"date":"2025-09-11T15:01:15","date_gmt":"2025-09-11T15:01:15","guid":{"rendered":"https:\/\/cybersecuritynews.com\/?p=125841"},"modified":"2025-09-12T16:00:45","modified_gmt":"2025-09-12T16:00:45","slug":"salesloft-drift-data-breaches","status":"publish","type":"post","link":"https:\/\/cybersecuritynews.com\/salesloft-drift-data-breaches\/","title":{"rendered":"Lessons from Salesforce\/Salesloft Drift Data Breaches – Detailed Case Study"},"content":{"rendered":"\n

The Salesloft Drift data breaches of August 2025 stand as one of the most significant supply chain attacks in SaaS<\/a> history, demonstrating how a single compromised integration can cascade into widespread organizational exposure.<\/p>\n\n\n\n

This sophisticated campaign, staged by the threat actor UNC6395<\/a>, exploited OAuth token vulnerabilities to access sensitive data from over 700 organizations, including major cybersecurity vendors like Cloudflare, Palo Alto Networks, and Zscaler.<\/p>\n\n\n\n

The incident reveals critical weaknesses in third-party application security and offers valuable lessons for strengthening enterprise cyber resilience.<\/p>\n\n\n\n

\"Salesloft
Salesloft Drift breach attack timeline from GitHub compromise to data exfiltration<\/figcaption><\/figure>\n\n\n\n

Initial Compromise: The GitHub Account Breach<\/strong><\/h2>\n\n\n\n

The attack timeline reveals a methodical approach that began months before the public disclosure. According to Mandiant’s investigation, the threat actor UNC6395 first gained access to Salesloft’s GitHub account<\/a> in March 2025, maintaining persistent access through June 2025.<\/p>\n\n\n\n

This initial compromise represents a critical security failure that went undetected for three months.<\/a><\/p>\n\n\n\n

During this extended access period, the attackers demonstrated sophisticated operational security by conducting reconnaissance activities across both the Salesloft and Drift<\/a> application environments.<\/p>\n\n\n\n

They systematically downloaded content from multiple repositories, added guest users, and established workflows that would later facilitate the mass data exfiltration campaign.<\/p>\n\n\n\n

This extended time allowed the threat actors to thoroughly understand the target environment and identify the most valuable attack vectors.<\/a><\/p>\n\n\n\n

The GitHub compromise highlights a fundamental challenge in modern software development: the security of code repositories and development infrastructure. <\/p>\n\n\n\n

Salesloft has not disclosed how the initial GitHub access was obtained, but this gap in transparency has drawn criticism from security analysts who emphasize the importance of understanding root causes for effective remediation.<\/p>\n\n\n\n

\"\"\/
OAuth token compromise attack flow diagram<\/figcaption><\/figure>\n\n\n\n

Drift Platform Exploitation and OAuth Token Theft<\/strong><\/h2>\n\n\n\n

Following their reconnaissance phase, the attackers pivoted to exploit Drift’s Amazon Web Services (AWS) environment, where they successfully obtained OAuth tokens<\/a> for Drift customers’ technology integrations.<\/p>\n\n\n\n

This represents the critical supply chain vulnerability that enabled the widespread attack across hundreds of organizations.<\/a><\/p>\n\n\n\n

OAuth tokens serve as digital keys that authorize applications to access user data across different platforms without requiring password authentication.<\/p>\n\n\n\n

In the case of Drift, these tokens enabled the chatbot platform to integrate with customer systems like Salesforce, Google Workspace, and other business applications.<\/p>\n\n\n\n

By stealing these tokens, UNC6395 effectively inherited the same trusted access privileges, allowing it to bypass traditional security controls.<\/a><\/p>\n\n\n\n

The technical sophistication of this phase is evident in the attackers’ ability to access AWS-hosted OAuth credentials and extract them without detection.<\/p>\n\n\n\n

This suggests a deep understanding of cloud infrastructure and token management systems, characteristic of advanced persistent threat (APT) groups.<\/a><\/p>\n\n\n\n

Between August 8 and 18, 2025, UNC6395 launched a systematic data exfiltration campaign targeting Salesforce instances<\/a> connected through Drift integrations. The attackers employed sophisticated techniques to maximize data theft while attempting to evade detection.<\/p>\n\n\n\n

The primary objective of the campaign was credential harvesting rather than immediate data monetization. UNC6395 systematically searched through exfiltrated data for valuable secrets, including:<\/a><\/p>\n\n\n\n