🔴 REAL INCIDENT: Salesloft Drift → Salesforce OAuth supply-chain data theft (August 2025)
What Happened
In August 2025, an AI sales chatbot became a skeleton key.
Not because the Salesforce platform was cracked. Not because hundreds of companies each failed MFA. Because one trusted integration—Salesloft's Drift chat agent—held OAuth tokens that looked, to Salesforce, like a legitimate connected app.
Google Threat Intelligence Group (GTIG) tracked the actor as UNC6395. Cloudflare's threat team labeled the same activity GRUB1. Beginning as early as August 8, 2025, through at least August 18, the actor used stolen Drift OAuth tokens to walk into customer Salesforce instances and systematically export data.
FINRA later summarized the blast radius for broker-dealers: the campaign impacted more than 700 organizations.
On August 20, Salesloft and Salesforce revoked Drift access and refresh tokens and pulled the Drift app from the Salesforce AppExchange pending investigation. Disclosures rolled through late August and early September. By then, the support-case text—and whatever secrets customers had pasted into it—was already gone.
Who Ran It / What Broke
Who ran the agent: Salesloft Drift, an AI chat agent used on websites for lead capture and customer contact. Many enterprises wired Drift into Salesforce (and, in some configurations, Google Workspace and other platforms) so chat leads and case context could flow into CRM.
What broke: Not Salesforce core. The integration trust model.
GTIG's advisory is blunt: compromised OAuth tokens associated with the Salesloft Drift third-party application let the actor impersonate Drift. Once inside, they queried Salesforce objects—Accounts, Users, Opportunities, Cases—and exported large volumes of data. Primary intent, GTIG assessed: harvest credentials.
The actor hunted secrets inside the stolen corpus. GTIG observed targeting of AWS access keys (AKIA-pattern identifiers), passwords, and Snowflake-related tokens. They deleted query jobs to cover tracks. Logs remained—if anyone was looking.
Cloudflare's public post puts a face on one victim tenant. Cloudflare uses Salesforce for customer support and case management; Drift was the website chat path into that world. The actor hit Cloudflare's Salesforce between August 12–17, 2025, after reconnaissance on August 9. Exposure was limited to case text (subject, body, contact fields)—not attachments. Still enough: Cloudflare scanned the compromised case data, found 104 Cloudflare API tokens, rotated them all, and reported no associated suspicious activity at the time of writing. Customers whose data was in those cases were notified.
FINRA's alert adds the industry-risk framing firms care about: stolen contact records plus secrets in cases raise credential stuffing, spear phishing, and social engineering risk against member firms and their vendors. Multiple third-party vendors used by FINRA firms were among those impacted.
This was a supply-chain failure at the agent integration layer. The chatbot was the trusted face. The OAuth tokens were the keys. The CRM was the vault.
Timeline (Verified)
| When (2025) | What |
| --- | --- |
| ~Aug 8–18 | UNC6395 / GRUB1 uses Drift OAuth tokens against Salesforce customers (GTIG: as early as Aug 8 through at least Aug 18) |
| Aug 9–17 | Cloudflare-reconstructed GRUB1 activity in Cloudflare's Salesforce tenant (recon → Bulk API case exfil → job delete) |
| Aug 20 | Salesloft + Salesforce revoke Drift tokens; Drift removed from AppExchange pending investigation |
| Aug 23+ | Vendor notifications; Cloudflare and others escalate incident response |
| Aug 26+ | GTIG public advisory; subsequent updates expand scope beyond Salesforce-only Drift integrations |
| Sep 2 | Cloudflare publishes detailed customer-facing incident post |
Why Support Cases Were the Jackpot
Support systems are where urgency beats hygiene.
Customers paste tokens "just this once." Engineers drop log snippets with embedded keys. Sales notes capture configuration details that should never leave a secrets manager. None of that is Salesforce's fault. All of it becomes catastrophic when a connected AI agent's tokens are stolen and Cases become a bulk-export target.
Cloudflare's recommendation to its own customers—and FINRA's to member firms—converges: treat anything shared in support cases during the window as potentially compromised; rotate; hunt.
GTIG went further for Drift customers: treat authentication tokens stored in or connected to the Drift platform as potentially compromised, and review all third-party integrations tied to a Drift instance—not only Salesforce.
The Governance Gap
Every enterprise running an AI agent into a system of record faces the same design question Drift answered the wrong way for hundreds of orgs:
How much standing power does this agent get—and who notices when that power is abused?
What failed here was not a clever zero-day in Salesforce. It was:
1. Broad, persistent OAuth trust for a conversational agent that needed CRM write/read to be "useful."
2. Weak operational visibility into connected-app behavior—Bulk API exports, odd User-Agents, Tor/cloud IPs—until vendors pieced the campaign together.
3. Secrets living in free-text case fields—an unmonitored secondary exfil channel waiting for anyone with Case access.
4. Least privilege as optional. Overly permissive connected-app scopes (full and friends) turn a chatbot outage into a multi-tenant CRM breach.
You can revoke tokens after the fact. You cannot un-exfiltrate Cases.
Takeaway
If your AI sales agent can open Cases, read Accounts, and speak with the authority of a connected app, it is not a widget on the website. It is a privileged operator.
Treat agent OAuth like production credentials: minimum scopes, IP restrictions where possible, short-lived sessions, continuous monitoring of anomalous exports, and a hard ban on secrets in support text. When—not if—an integration is compromised, you need to know what the agent could touch, what it did touch, and which secrets rode along in the case stream.
An AI chatbot with a skeleton key does not need to be smart. It only needs to be trusted.
Sources
- Google Threat Intelligence Group / Google Cloud: *Widespread Data Theft Targets Salesforce Instances via Salesloft Drift* (Aug 26, 2025, with updates)
- Cloudflare Blog: *The impact of the Salesloft Drift breach on Cloudflare and our customers* (Sep 2, 2025)
- FINRA Cybersecurity Alert: *Salesloft Drift AI Supply Chain Attack* guidance for member firms