Salesloft Drift OAuth Tokens Enable Widespread SaaS Data Theft

What happened

Google Threat Intelligence documented data theft from 8 through 18 August using compromised Drift OAuth tokens. Salesloft later reported that the intrusion involved access to Drift's environment and customer integration tokens, and FINRA warned that more than 700 organizations were affected.

Technical mechanism

The actor authenticated with stolen OAuth credentials, queried connected SaaS data at scale, searched exported records for secrets, and deleted query jobs while leaving other audit evidence available. The campaign did not arise from a vulnerability in the core Salesforce platform.

Why it matters

The campaign exposed the systemic risk of trusted third-party integrations whose long-lived tokens can bypass ordinary sign-in controls and provide broad access across many customer tenants.

Impact

Affected environments could expose business records and embedded credentials such as API keys, cloud keys, passwords, and access tokens. The data increased risks of follow-on credential theft, phishing, and compromise of connected systems.

Response

Salesloft and Salesforce revoked Drift tokens, integrations were disabled during investigation, Google revoked affected Workspace tokens, and customers were directed to review audit logs and rotate credentials reachable through connected applications.

Defensive lessons

• Inventory every third-party OAuth application, token, scope, owner, and connected data set
• Monitor post-authentication API queries and unusual bulk export, not only interactive logins
• Search collaboration and support systems for embedded secrets and rotate them after integration compromise

Evidence register

1. Google Threat Intelligence Group and Mandiant — Widespread Data Theft Targets Salesforce Instances via Salesloft Drift (verified)
2. FINRA — Cybersecurity Alert – Salesloft Drift AI Supply Chain Attack (verified)