In August 2025, Google Threat Intelligence reported that an actor used compromised OAuth tokens tied to the Salesloft Drift app to export data from many Salesforce instances. The lesson for integration owners is that a connected app's token is a credential into your systems, and you must be able to revoke and review it fast.
What the source reports
Google Threat Intelligence Group tracks the actor as UNC6395. Its advisory states:
- Earliest observed activity was on 8 August 2025.
- On 20 August 2025, Salesloft, with Salesforce, revoked all active access and refresh tokens for the Drift application, and Salesforce removed Drift from its app marketplace pending investigation.
- The actor exported large volumes of data from objects such as cases, accounts, users and opportunities.
- Google assessed the main intent as credential harvesting. The actor searched the exported data for secrets, including cloud access keys, passwords and other access tokens.
- An update on 28 August said the compromise was not limited to the Salesforce integration, and that a very small number of Google Workspace accounts configured with the Drift email integration were also accessed. Google states that no other accounts on those domains could be reached.
- Google states the issue did not stem from a vulnerability in the core Salesforce platform.
This post does not add detail beyond the advisory. Read it directly for indicators and dates.
Lessons that apply to your integrations
A token is a standing key. The attacker did not break the customers' systems. They used credentials that were already trusted. Every connected app is a path that works without a password prompt.
Support data holds secrets. Cases and notes in a CRM are where people paste keys and passwords. Google's recommended actions included searching those records for secrets and rotating anything found. Do this search on your own systems before an incident.
You need a way to say "revoke everything for this app". The vendor revoked all tokens in one move. You should know how to do the same from your side.
Scope and network limits help. Google's advice included restricting connected app scopes rather than granting full access, enforcing IP restrictions and limiting who holds API access.
What to do this week
- List every app connected to your CRM, mail and chat tools. Note owner, scopes and last use.
- Remove ones nobody can name an owner for.
- For the rest, check that scopes are the minimum.
- Search ticket and note fields for pasted secrets, and rotate any you find.
- Turn on logging for connected app activity and decide who reviews it.
- Write down the steps to revoke an app's tokens, and test them once.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how continuous checks surface a change after the fact, which is the habit integration owners need for connected app activity.
Quick check
Was this a flaw in the CRM platform?
Google states the issue did not stem from a vulnerability in the core Salesforce platform. It involved compromised tokens tied to a third-party app.
Is rotating my own passwords enough after a vendor token incident?
No. Revoke the app's tokens, review activity logs, and rotate any secret that may have been stored in the connected systems.
Safeguard's asset discovery and compliance evidence automation can help keep a reviewed list of connected apps. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
