Recent cybersecurity news has shifted focus from AI and ransomware to breaches, particularly those involving compromised OAuth tokens linked to Salesloft's Drift integration. The main themes emerging are supply chain and identity attacks, with a need to redefine these concepts in the context of SaaS environments. Supply chain attacks now extend beyond hardware and software to include the datapath, while identity attacks increasingly target interconnected applications. The article emphasizes the importance of broadening cybersecurity focus and introduces the Cyber Threat Intelligence Capability Maturity Model (CTI-CMM) as a framework for organizations to assess and enhance their cyber threat intelligence programs.
For the latest discoveries in cyber research for the week of 8th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES A supply chain breach involving Salesloft’s Drift integration to Salesforce exposed sensitive customer data from multiple organizations, including Cloudflare, Zscaler, Palo Alto Networks, and Workiva. The attackers accessed Salesforce CRM systems via […] The post 8th September – Threat Intelligence Report appeared first on Check Point Research .
A comprehensive investigation has uncovered numerous indicators of malicious activity related to a specific incident. Organizations are urged to scrutinize their logs for signs of compromise using the provided Indicators of Compromise (IOCs). The analysis reveals that legitimate Drift integration traffic should originate from a set of known source IPs owned and operated by Drift. Any successfully authenticated connections using Drift tokens from IP addresses not listed in the official document should be treated as suspicious and potentially malicious. The findings include a list of confirmed malicious IP addresses and suspicious User-Agent strings (See reference). While these IPs are confirmed malicious, some may generate noise since they are associated with Tor exit nodes. Organizations are advised to consider any traffic from these IPs to a Drift integration with a successfully authenticated Drift connection as malicious
The Salesloft-Drift Breach: Analyzing the Biggest SaaS Breach of 2025
Source: https://www.reco.ai/blog/the-salesloft-drift-breach-analyzing-the-biggest-saas-breach-of-2025
MeetC2 - A serverless C2 framework that leverages Google Calendar APIs as a communication channel
Source: https://securityaffairs.com/181940/security/meetc2-a-serverless-c2-framework-that-leverages-google-calendar-apis-as-a-communication-channel.html
Max severity Argo CD API flaw leaks repository credentials
Source: https://www.bleepingcomputer.com/news/security/max-severity-argo-cd-api-flaw-leaks-repository-credentials/
U.S. CISA adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog
Source: https://securityaffairs.com/181924/breaking-news/u-s-cisa-adds-sitecore-android-and-linux-flaws-to-its-known-exploited-vulnerabilities-catalog.html
This analysis examines a campaign distributing Atomic macOS Stealer (AMOS), targeting macOS users through fake 'cracked' applications. Attackers use two main delivery methods: malicious .dmg installers and terminal commands that bypass Gatekeeper protection. AMOS employs rotating domains to evade detection and steals a wide range of sensitive data, including credentials, browser information, cryptocurrency wallets, and system files. The campaign demonstrates sophisticated tactics, adapting to macOS security improvements and leveraging social engineering. The report emphasizes the importance of comprehensive endpoint detection, user education, and defense-in-depth strategies to combat such threats.
