A sales chatbot integration became the pivot point for one of the largest SaaS supply-chain data thefts on record. Attackers obtained OAuth access and refresh tokens belonging to the Salesloft Drift integration for Salesforce, then used that trusted authorization to enumerate and export CRM data from hundreds of downstream customer organizations without ever cracking a password or tripping a login alert. Microsoft, the highest-tier source available here, confirms the activity as part of a campaign series running from mid-2025 into mid-2026 with tradecraft it associates with ShinyHunters, and states plainly that this was not the result of a vulnerability in Salesforce itself. Scale figures vary widely by source: PrivacyOn and Netskope both put the victim count at "more than 700" organizations, while GCN reports 760 firms and roughly 1.5 billion records exfiltrated. That 1.5 billion figure appears in only one lower-tier source and should be treated as unconfirmed.
What Happened
Cyera reports that the attackers broke into Salesloft's GitHub repositories and stole OAuth tokens belonging to the Drift integration. Because Drift held standing authorization to read data across every Salesforce environment that had ever connected it, one stolen token set opened the door to every one of those tenants at once. PrivacyOn attributes the intrusion to the actor Google tracks as UNC6395, also referred to as "Icarus" and closely tied to the ShinyHunters extortion crew.
Accounts differ sharply on dwell time. GCN frames the intrusion as five months of undetected access. PrivacyOn, by contrast, dates the active exfiltration window narrowly to August 8 through August 18, 2025. Those are not reconcilable as stated, and the likeliest explanation is that they measure different things: initial repository compromise and token harvesting on one hand, bulk export activity on the other. Neither figure carries PRIMARY backing. Microsoft's own framing is broader still, describing campaign activity spanning mid-2025 to mid-2026 across multiple trusted integrations including both Salesloft and Gainsight.
Mitiga Labs says it was tracking the anomaly before public disclosure, having flagged Tor exit node traffic interacting with Salesforce through an app called Drift. Mitiga also draws an important distinction that several accounts blur: UNC6040 ran the vishing-plus-OAuth-device-flow campaign against Salesforce tenants, while UNC6395 ran the Drift token campaign. Two campaigns, overlapping tooling, different entry points.
Remediation was blunt and total. Improvado reports that on August 20, 2025, the vendor and Salesforce revoked all active access and refresh tokens for the application. Cyera adds that Salesforce disabled the Drift app and Salesloft subsequently shut it down entirely.
What Was Taken
The stolen material was CRM data, and its composition varied by victim because each organization populated Salesforce differently. PrivacyOn lists confirmed exposed fields across affected companies as full name, email address, phone number, company name and job title, business address, and support case text including the content of tickets and correspondence. Support cases, contact records, and account data were the primary targets.
Volume claims span three orders of magnitude depending on who is counting and what unit they use. GCN's 1.5 billion records across 760 firms is the highest number in circulation and is single-sourced. Cyera describes a single large enterprise victim that found nearly 1,000 query datasets compromised, totaling over 4 million files, which the firm ingested and classified in 12 hours. PrivacyOn names Cloudflare, Palo Alto Networks, Zscaler, Proofpoint, TransUnion, and Workday among the affected, noting that investigations continued into 2026 as more companies confirmed exposure and mailed notification letters.
The more consequential detail is what the attackers were hunting inside that data. Cyera reports that threat actors were specifically searching stolen records for secrets and credentials embedded in customer environments: API keys, tokens, and passwords pasted into support tickets. That converts a CRM breach into a staging point for downstream intrusions. Cyera further notes that during one response, both the customer's internal team and their IR provider scanned the stolen data with TruffleHog and returned matching results, but a subsequent scan surfaced credentials the earlier passes had missed. Cyera is describing its own product engagement, so weigh that accordingly, but the underlying point that secret-scanning coverage is uneven stands on its own.
Separately, Cyera reports that Google issued warnings to 2.5 billion Gmail users in connection with the incident. That claim appears in one lower-tier source and is not corroborated elsewhere in this set.
Why It Matters
This breach inverts the normal blast radius calculation. A conventional compromise exposes one company's customers. Here, a single vendor's repository hygiene failure exposed the customer data of every organization downstream of that integration, including some of the most security-mature companies in the industry. Cloudflare, Palo Alto Networks, Zscaler, and Proofpoint all sell security products. None of that mattered, because the authorization was legitimate and the traffic looked legitimate.
Netskope frames the structural problem precisely: MFA fires exactly once, at the moment a user consents to an OAuth grant. After that the token operates silently and indefinitely with no further human checkpoint. MFA governs authentication, who gets in. OAuth governs authorization, what can be done. They run on separate rails, and compromising the token bypasses the MFA layer entirely. Netskope cites Proofpoint's finding that 59% of taken-over accounts had MFA enabled, and the Verizon DBIR 2025 finding that third-party involvement appeared in 30% of all breaches, double the prior year's 15%.
Improvado points at the second blast, the one defenders consistently fail to plan for. When a vendor cannot determine which specific customers' tokens were taken, it revokes at the integration level, and every customer of that integration loses the connection at once. Syncs stop. Pipelines stop. Dashboards go dark. Improvado argues that revenue and marketing teams feel this hardest, not because they hold the most integrations but because theirs are the least inventoried and the least represented in continuity planning. The organizational question of who owns the revocation switch and can throw it within the hour is one most companies answer for the first time during the incident.
Netskope's forward projection is the part worth sitting with. If every AI agent a user launches holds roughly 10 OAuth grants, a 1,000-employee company running five agents per person is carrying exposure across 50,000 active tokens, most issued months ago and never reviewed. Across major enterprise platforms the default is for credentials to persist until someone explicitly revokes them, not until a timer expires.
The Attack Technique
The Drift path required no exploit against Salesforce and no credential phishing against end users. Attackers reached Salesloft's source repositories, extracted the OAuth access and refresh tokens stored there, and replayed them against Salesforce APIs. The tokens carried the integration's inherited privileges, which is what made bulk record enumeration and export possible while evading conventional authentication detections. Microsoft describes exactly this pattern: abuse of trusted OAuth relationships for unauthorized access, data exfiltration, and persistence, with a single entry point rapidly expanding to enterprise-wide impact.
The parallel UNC6040 campaign documented by Mitiga worked differently and is worth knowing so defenders do not chase the wrong indicators. There the attacker configured OAuth device flow via a local Salesforce Data Loader, generating an 8-character code, then vished an English-speaking employee while impersonating IT support and talked them into entering that code on Salesforce's verification page. Approval issued an access token to the attacker's Data Loader instance, and all subsequent actions ran on behalf of the victim. Same abuse of trust, opposite direction of approach.
Microsoft notes it observed this class of activity across many tenants in retail, education, and manufacturing, and that it worked with Salesforce to improve telemetry granularity in Defender for Cloud Apps, adding near-real-time detection with connected application attribution and expanded application permission insights.
What Organizations Should Do
-
Build a credential inventory before you need one. Enumerate every third-party integration holding OAuth grants against your CRM, identity provider, mail, and file platforms. Record what scopes each holds, when the grant was issued, and which internal team depends on it. Improvado's core point is that the companies hit hardest were the ones that could not answer these questions under time pressure.
-
Assign the revocation switch to a named owner. Decide in advance who can revoke all tokens for a given integration within the hour, and what breaks when they do. Run this as a tabletop exercise against your highest-scope connector, and involve revenue and marketing operations, because their pipelines are the ones that silently die.
-
Turn on Salesforce event monitoring and watch OAuth-connected apps specifically. Microsoft explicitly recommends this, alongside validating third-party integrations and reviewing configurations. Authentication logs will not surface this activity, because there is no anomalous authentication to surface.
-
Alert on anomalous API access patterns from connected apps. Mitiga's first signal was Tor exit node traffic hitting Salesforce through Drift. Volume spikes, novel source geographies, anonymizing infrastructure, and bulk export calls from an integration that normally makes low-volume reads are all detectable without knowing the specific IOCs.
-
Treat CRM free-text fields as credential stores. Attackers mined support case text for embedded secrets. Scan your own ticket bodies and note fields for API keys and tokens, purge what you find, and rotate anything that ever appeared there.
-
Expire and re-consent OAuth grants on a schedule. Netskope's finding that credentials persist by default until explicitly revoked is the underlying defect. Impose a review and rotation cadence on grants your platform will otherwise keep alive forever, and apply it to AI agent connectors before that population grows past the point of manual review.
-
Assume notification will arrive late and in waves. PrivacyOn notes affected companies were still confirming exposure and mailing letters into 2026. If you were a Drift customer, do not wait on a vendor letter to begin scoping what data lived in your Salesforce instance during the exposure window.
Sources: A sales chatbot's OAuth tokens hidden in a code repository helped r... | Defending SaaS-based applications against ShinyHunters ... | Salesloft Drift Breach: What to Do Now (700+ Firms Hit) PrivacyOn | ShinyHunters and UNC6395: Inside the Salesforce ... | OAuth Token Revocation Risk in the Marketing Stack | AI Agents and the OAuth Trust Problem at Scale | Recovering from the Salesloft Breach | Lessons from the Salesloft Drift Exposure Cyera Blog