Warning issued to Salesforce customers after hackers stole Salesloft Drift data
Customers were targeted through compromised OAuth access tokens from Salesloft Drift integrations
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
You are now subscribed
Your newsletter sign-up was successful
Google’s Threat Intelligence Group (GTIG) has revealed that hackers harvested user credentials from Salesforce customers in a widespread campaign during the first half of this month.
The attacker, tracked as UNC6395, targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft Drift third-party application.
"The actor systematically exported large volumes of data from numerous corporate Salesforce instances. GTIG assesses the primary intent of the threat actor is to harvest credentials," researchers said in an advisory.
"After the data was exfiltrated, the actor searched through the data to look for secrets that could be potentially used to compromise victim environments."
These secrets included sensitive credentials such as Amazon Web Services (AWS) access keys (AKIA), passwords, and Snowflake-related access tokens.
"The techniques used in this campaign weren’t novel in terms of exploitation. The attacker didn’t need to break Salesforce itself, they abused OAuth tokens from a widely used and trusted third-party integration to gain access," commented Cory Michal, CSO of AppOmni.
"They then used that foothold in a very disciplined and methodical way. They ran structured SOQL queries, targeted high-value data like credentials, and attempted to cover their tracks by deleting jobs."
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Salesloft, working with Salesforce, has now revoked all active access and refresh tokens within the Drift application. Salesforce has also removed the Drift application from the Salesforce AppExchange until further notice, pending further investigation.
While UNC6395 demonstrated operational security awareness by deleting query jobs, researchers said logs weren't affected. As such, organizations should still review relevant logs for evidence of data exposure.
They should search for sensitive information and secrets contained within Salesforce objects and take appropriate action, such as immediately revoking API keys, resetting passwords, rotating credentials, and reviewing permissions.
Researchers also urged enterprises to carry out investigations to determine whether any secrets have been abused.
“This campaign underscores that highly permissioned OAuth and SaaS-to-SaaS integrations represent one of the largest risks and blind spots for organizations today. Once an integration is compromised, attackers can operate with the same level of access granted to that app, often bypassing traditional MFA controls," said Michal.
"The risk is compounded if organizations are insecurely storing secrets, API keys, or credentials in Salesforce objects. In those cases, if the data was exfiltrated, it’s very likely that connected systems such as AWS, Snowflake, or VPNs have already been compromised as well. That makes the blast radius of these attacks far larger than just the SaaS application itself."
The report doesn't identify UNC6395, but the sophistication of the operation implies a state-sponsored attacker, Michal said.
"What’s most noteworthy about the UNC6395 attacks is both the scale and the discipline. This wasn’t a one-off compromise; hundreds of Salesforce tenants of specific organizations of interest were targeted using stolen OAuth tokens, and the attacker methodically queried and exported data across many environments," said Michal.
"The combination of scale, focus, and tradecraft makes this campaign stand out."
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- A notorious hacker group is ramping up cloud-based ransomware attacks
- Hackers breached a 158 year old company by guessing an employee password
- Cyber criminals are abusing ConnectWise ScreenConnect, again
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
Sumo Logic expands European footprint with AWS Sovereign Cloud dealNews The vendor is extending its AI-powered security platform to the AWS European Sovereign Cloud and Swiss Data Center
-
Going all-in on digital sovereigntyITPro Podcast Geopolitical uncertainty is intensifying public and private sector focus on true sovereign workloads
-
Using AI to generate passwords is a terrible idea, experts warnNews Researchers have warned the use of AI-generated passwords puts users and businesses at risk
-
Researchers called on LastPass, Dashlane, and Bitwarden to up defenses after severe flaws put 60 million users at risk – here’s how each company respondedNews Analysts at ETH Zurich called for cryptographic standard improvements after a host of password managers were found lacking
-
‘They are able to move fast now’: AI is expanding attack surfaces – and hackers are looking to reap the same rewards as enterprises with the technologyNews Potent new malware strains, faster attack times, and the rise of shadow AI are causing havoc
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacksNews Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Notepad++ hackers remained undetected and pushed malicious updates for six months – here’s who’s responsible, how they did it, and how to check if you’ve been affectedNews Hackers remained undetected for months and distributed malicious updates to Notepad++ users after breaching the text editor software – here's how to check if you've been affected.
-
CISA’s interim chief uploaded sensitive documents to a public version of ChatGPT – security experts explain why you should never do thatNews The incident at CISA raises yet more concerns about the rise of ‘shadow AI’ and data protection risks
-
Former Google engineer convicted of economic espionage after stealing thousands of secret AI, supercomputing documentsNews Linwei Ding told Chinese investors he could build a world-class supercomputer
-
90% of companies are woefully unprepared for quantum security threats – analysts say they need to get a move onNews Quantum security threats are coming, but a Bain & Company survey shows systems aren't yet in place to prevent widespread chaos
