Salesloft Drift, August 2025: revoke the OAuth tokens, not just the app
A months-long compromise of Salesloft's GitHub became, in August 2025, a harvest of customer Salesforce data through Drift's OAuth tokens. Salesforce left Drift disconnected.
In August 2025 a cluster Mandiant tracks as UNC6395 used OAuth tokens from the Salesloft Drift integration to query customers' Salesforce instances. Palo Alto Networks, Zscaler, Proofpoint and Cloudflare were among the companies that said their Salesforce data was in scope.
Salesloft's update, reported by Cybersecurity Dive on 8 September 2025, said Mandiant found the attacker in Salesloft's GitHub account between March and June 2025, and later in Drift's AWS environment, where the customer tokens lived. Salesforce restored other Salesloft integrations and kept Drift disabled.
What was stolen, and what was not
The tokens were Drift's, issued so the chat product could act in a customer's Salesforce. With those tokens the attacker did not need a user's password for each tenant. The breach of the integration vendor became access to the customers.
This was not a vulnerability in Salesforce's multitenant platform announced as a CVE that week. It was a connected app. Customers who had never installed Drift were not in this token set. Customers who had installed it and forgotten it were.
What those tokens could see
Whatever the Drift connected-app scopes allowed in that org: typically contacts, cases and the objects an integration was granted, plus any credentials a team had stored in Salesforce fields. The public confirmations from security vendors were about their own CRM data, not about a break of their product that customers run.
Google and others published indicators for the campaign. The useful local question is narrower: did our org have a Drift refresh token in August 2025, and what did that token's scopes include?
What the vendors told customers to do
Revoke Drift's OAuth tokens and connected-app access in Salesforce, rotate any secret that lived in records the integration could read, and review login and API history for the dates of the campaign. Salesforce's decision to keep Drift disconnected was the platform-side half. The tenant-side half is the revoke, which a disabled marketplace listing does not perform by itself.
Salesloft said it rebuilt access after the GitHub finding. A customer cannot audit that rebuild. A customer can audit their own connected apps.
The inventory to keep
Export the list of connected apps and the last time each token was used. Remove the ones nobody can name. Prefer scopes that are not 'full access', and store secrets outside the CRM objects an integration reads.
When a vendor says their GitHub was occupied for a quarter, assume every token that vendor held for you is burnt until you revoke it. That rule is older than Drift. August 2025 is the reminder with names on it. The patching version is not a Drift client build. On 20 August 2025 Salesloft and Salesforce revoked the active Drift access and refresh tokens. That revocation is the control the advisories name.
Cybersecurity Dive, 8 September 2025, on Mandiant's finding in Salesloft's GitHub and the Drift tokens.
https://www.cybersecuritydive.com/news/salesloft-drift-restored-probe-github/759506/
Frequently asked questions
Was this a Salesforce CVE?
No CVE in Salesforce's platform was the story. UNC6395 used OAuth tokens stolen from the Drift integration after a compromise of Salesloft, traced by Mandiant to GitHub access between March and June 2025.
Does uninstalling Drift finish the response?
Uninstall, and revoke the tokens and the connected app. A token issued earlier can remain valid after the listing is hidden. Rotate secrets that sat in records Drift could read.
Who said they were affected?
Palo Alto Networks, Zscaler, Proofpoint and Cloudflare confirmed Salesforce data exposure in the public reporting of the campaign. Check your own org rather than inferring from that list.