UnknownPublished 5 Sep 2025

OSINT · Widespread Data Theft Targets Salesforce Instances via Salesloft Drift

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

OSINT - Widespread Data Theft Targets Salesforce Instances via Salesloft Drift

Impact

For European organizations, this threat poses significant risks to the confidentiality and integrity of customer and business data stored in Salesforce instances. Successful exploitation could lead to large-scale data breaches, exposing sensitive personal and corporate information, which may result in regulatory penalties under GDPR and damage to reputation. The theft of cloud credentials can enable attackers to move laterally within cloud environments, potentially compromising additional services beyond Salesforce. Organizations relying on Salesloft and Drift integrations are particularly vulnerable, as these platforms may provide additional attack vectors. The disruption to business operations could be moderate if attackers manipulate or delete data, though availability impact appears limited. Given the widespread use of Salesforce across Europe, the threat could affect multiple sectors including finance, healthcare, and retail. The medium severity rating reflects the moderate certainty and current lack of active exploitation, but the potential for significant damage if exploited is high. The threat underscores the need for enhanced cloud security posture management and integration security reviews.

Defensive guidance

European organizations should implement strict access controls and enforce the principle of least privilege for all cloud credentials, especially those accessible via metadata APIs. Regularly audit and monitor cloud instance metadata API usage to detect anomalous or unauthorized access patterns. Segregate duties and limit the scope of credentials accessible to Salesloft, Drift, and other third-party integrations. Employ multi-factor authentication and conditional access policies for cloud management consoles and SaaS platforms. Conduct thorough security assessments of Salesforce integrations to identify and remediate misconfigurations. Use cloud security posture management (CSPM) tools to continuously evaluate and enforce secure configurations. Implement logging and alerting on suspicious credential usage or data exfiltration attempts. Educate IT and security teams on the risks associated with cloud metadata APIs and credential theft. Prepare incident response plans specifically addressing cloud credential compromise and data theft scenarios. Engage with vendors to track updates or patches related to this threat and apply them promptly once available.

Indicators of compromise

IP addresses 20

208.68.36.90DigitalOcean
44.215.108.109Amazon Web Services
154.41.95.2Tor exit node
176.65.149.100Tor exit node
179.43.159.198Tor exit node
185.130.47.58Tor exit node
185.207.107.130Tor exit node
185.220.101.133Tor exit node
185.220.101.143Tor exit node
185.220.101.164Tor exit node

User agent 4

python-requests/2.32.4risk of FP - weak indicator
Python/3.11 aiohttp/3.12.15risk of FP - weak indicator
Salesforce-Multi-Org-Fetcher/1.0Malicious User-Agent string
Salesforce-CLI/1.0Malicious User-Agent string

Link 1

https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift

Text 3

Google Threat Intelligence Group (GTIG) is issuing an advisory to alert organizations about a widespread data theft campaign, carried out by the actor tracked as UNC6395. Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft Drift third-party application. The actor systematically exported large volumes of data from numerous corporate Salesforce instances. GTIG assesses the primary intent of the threat actor is to harvest credentials. After the data was exfiltrated, the actor searched through the data to look for secrets that could be potentially used to compromise victim environments. GTIG observed UNC6395 targeting sensitive credentials such as Amazon Web Services (AWS) access keys (AKIA), passwords, and Snowflake-related access tokens. UNC6395 demonstrated operational security awareness by deleting query jobs, however logs were not impacted and organizations should still review relevant logs for evidence of data exposure. Based on data available at the time, Salesloft indicated that customers that do not integrate with Salesforce are not impacted by this campaign. On Aug. 20, 2025 Salesloft, in collaboration with Salesforce, revoked all active access and refresh tokens with the Drift application. In addition, Salesforce removed the Drift application from the Salesforce AppExchange until further notice pending further investigation. This issue does not stem from a vulnerability within the core Salesforce platform. GTIG, Salesforce, and Salesloft have notified impacted organizations.
Widespread Data Theft Targets Salesforce Instances via Salesloft Drift
Blog

Community reviews

Loading reviews…