Attackers tracked as UNC6395 stole OAuth refresh tokens belonging to Salesloft’s Drift integration with Salesforce. Those tokens permitted Drift to query Salesforce on behalf of its customers. Between 8 and 18 August 2025 the attackers used them to systematically query and export records from more than 700 organisations.
Named affected organisations include Cloudflare, Google, PagerDuty, Palo Alto Networks, Proofpoint, SpyCloud, Tanium and Zscaler. On 20 August, Salesloft and Salesforce revoked all Drift OAuth tokens and the application was removed from the AppExchange pending investigation.
This Is The File Every OAuth Argument In This Database Points At
This desk filed the mechanism at 26-0611 — a vendor’s token store is a key ring for its entire integrated customer base — and the technique for obtaining consent at 26-0607. This is that mechanism at its largest observed scale.
Nothing was exploited in any customer environment. The tokens were used exactly as designed, from infrastructure the customer’s logs expected them to come from, performing queries the integration was authorised to perform.
The Victim List Is Unusually Sophisticated
The affected organisations include several of the most capable security companies in the industry. That is worth stating plainly, in the same spirit as the Google file at 26-0619: this was not a failure of security maturity.
A customer cannot detect misuse of a token they granted, held by a third party, used from that third party’s infrastructure. The control was never on their side of the boundary.
What A Customer Could Actually Have Done
Scoped the grant more tightly than the integration requested. Set an expiry. Monitored export volume from connected applications rather than only authentication events. Each is available in the platform and each is commonly left at the permissive default, for the reasons set out at 26-0607.
Compiled from published vendor research and company disclosures, listed below. Organisation counts and the victim list are as reported and as confirmed by the companies concerned. We have not reviewed tenant logs. Corrections: corrections@forensicpost.com.