Stolen tokens from Drift's AI chat agent used to raid 700+ companies' Salesforce data
What happened
A threat actor used stolen OAuth tokens from the Drift AI chat agent's Salesforce integration to export data from hundreds of company Salesforce instances, hunting for AWS keys, passwords and other secrets. Victims included Cloudflare, Palo Alto Networks, Zscaler and Google. Salesloft and Salesforce revoked all Drift tokens.
Drift is Salesloft's AI chat agent for company websites, and it connects to customers' Salesforce accounts through OAuth tokens so it can log conversations and leads. Mandiant traced the attack to a compromise of Salesloft's GitHub account as early as March 2025, from which the attacker, tracked by Google as UNC6395, reached Drift's AWS environment and stole the tokens Drift held for its customers' integrations. Between 8 and 18 August 2025 the attacker used them with an automated tool to export data from the Salesforce instances of hundreds of organizations, including accounts, contacts, sales opportunities and support cases, specifically hunting for AWS keys, Snowflake tokens, VPN credentials and passwords that customers had pasted into support tickets. They deleted their query jobs to cover their tracks, but the logs survived. Drift's email integration tokens were also abused to read a limited number of Google Workspace mailboxes. Confirmed victims included Cloudflare, Palo Alto Networks, Zscaler, Proofpoint, Qualys, Rubrik, CyberArk, Elastic and many others.
How it happened
Supply chain and access: Stolen token or key. Stolen or leaked access tokens, API keys or passwords were used to get in.
Sources do not say whose AI model was involved. The product was Drift, a type of chatbot.
Impact
Data was exposed. Data involved: credentials, personal data and internal documents. Many organizations were affected. Sources give a figure of 700.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It happened or began on 8 Aug 2025. It became public on 20 Aug 2025, 12 days later.
On 20 August Salesforce and Salesloft revoked all active Drift tokens and Salesforce removed the app from its marketplace. Salesloft took Drift offline, brought in Mandiant, and affected companies rotated the credentials found in their Salesforce data.
Sources
- https://www.finra.org/rules-guidance/guidance/salesloft-drift-AI-supply-chain-attack
- https://www.anomali.com/blog/salesloft-drift-breach-recap
- https://www.wtwco.com/en-us/insights/2025/09/the-drift-oauth-breach-a-cybersecurity-wake-up-call
- https://www.techtarget.com/cybersecurity/news/366630934/News-brief-Salesloft-Drift-breach-update-and-timeline