Google has revealed that the latest wave of assaults focusing on Salesforce situations through Salesloft Drift is way broader in scope than beforehand thought, stating it impacts all integrations.
“We now advise all Salesloft Drift prospects to deal with any and all authentication tokens saved in or linked to the Drift platform as probably compromised,” Google Menace Intelligence Group (GTIG) and Mandiant mentioned in an up to date advisory.
The tech big mentioned the attackers additionally used stolen OAuth tokens to entry electronic mail from a small variety of Google Workspace electronic mail accounts on August 9, 2025, after compromising the OAuth tokens for the “Drift E-mail” integration. It is value noting that this isn’t a compromise of Google Workspace or Alphabet itself.
“The one accounts that had been probably accessed had been those who had been particularly configured to combine with Salesloft; the actor wouldn’t have been capable of entry another accounts on a buyer’s Workspace area,” Google added.
Following the invention, Google mentioned it notified impacted customers, revoked the precise OAuth tokens granted to the Drift E-mail utility, and disabled the mixing performance between Google Workspace and Salesloft Drift amid ongoing investigation into the incident.
The corporate can also be urging organizations utilizing Salesloft Drift to evaluate all third-party integrations linked to their Drift occasion, revoke and rotate credentials for these purposes, and examine all linked techniques for indicators of unauthorized entry.
The broadening of the assault radius comes shortly after Google uncovered what it described as a widespread and opportunistic knowledge theft marketing campaign that allowed the risk actors, an rising exercise cluster dubbed UNC6395, to leverage compromised OAuth tokens related to Salesloft Drift to focus on Salesforce situations from August 8 to 18, 2025.
Salesloft has since revealed that Salesforce has quickly disabled the Drift integration between Salesforce, Slack, and Pardot, solely to observe it up practically three hours later, saying Salesforce has “elected to quickly disable all Salesloft integrations with Salesforce.”
“Primarily based on the investigation thus far, there is no such thing as a proof of malicious exercise detected within the Salesloft integrations associated to the Drift incident,” it famous. “Moreover, right now, there are not any indications that the Salesloft integrations are compromised or in danger.”
