Google now stories that the Salesloft Drift breach is bigger than initially thought, warning that attackers additionally used stolen OAuth tokens to entry a small variety of Google Workspace e mail accounts along with stealing knowledge from Salesforce situations.
“Based mostly on new info recognized by GTIG, the scope of this compromise is just not unique to the Salesforce integration with Salesloft Drift and impacts different integrations,’ warns Google.
“We now advise all Salesloft Drift clients to deal with any and all authentication tokens saved in or related to the Drift platform as probably compromised.”
The marketing campaign, tracked by Google Risk Intelligence (Mandiant) as UNC6395, was first disclosed on August 26 after attackers stole OAuth tokens for Salesloft’s Drift AI chat integration with Salesforce. The menace actors used these tokens to realize entry to buyer Salesforce situations, the place they executed queries in opposition to Salesforce objects, together with the Instances, Accounts, Customers, and Alternatives tables.
This knowledge allowed the attackers to scan buyer help tickets and messages for delicate info, similar to AWS entry keys, Snowflake tokens, and passwords that could possibly be used to breach additional cloud accounts, possible for future extortion.
In an replace printed as we speak, Google confirmed that the compromise was extra important than initially believed and never restricted to Salesforce integrations.
The investigation revealed that OAuth tokens for the “Drift E mail” integration had been additionally compromised, and on August 9, the menace actors utilized them to entry the e-mail of a “very small quantity” of Google Workspace accounts that had been instantly built-in with Drift.
Google emphasised that no different accounts in these domains had been impacted and that there was no compromise of Google Workspace or Alphabet itself.
The stolen tokens have since been revoked, and clients have been notified. Google additionally disabled the mixing between Salesloft Drift E mail and Google Workspace whereas they examine the breach.
Google is now urging all organizations utilizing Drift to deal with each authentication token saved in or related to the platform as compromised. This warning advises clients to revoke and rotate credentials for these purposes and examine all related techniques for indicators of unauthorized entry.
The corporate additionally recommends reviewing all third-party integrations related to Drift situations, looking for uncovered secrets and techniques, and resetting any discovered credentials in case they’ve been compromised.
Salesloft additionally up to date its advisory on August 28, stating that Salesforce has disabled Drift integrations with Salesforce, Slack, and Pardot till an investigation is accomplished.
The corporate has now engaged Mandiant and Coalition to help with this investigation.
46% of environments had passwords cracked, practically doubling from 25% final 12 months.
Get the Picus Blue Report 2025 now for a complete have a look at extra findings on prevention, detection, and knowledge exfiltration developments.
