⚡ Weekly Recap: Drift Breach Chaos, Zero-Days Active, Patch Warnings, Smarter Threats & More

Summary: Salesloft took Drift temporarily offline effective September 5, 2025, at 6 a.m. ET after a supply chain attack on the marketing SaaS product resulted in mass theft of authentication tokens and access to Salesforce data. Cloudflare, Google Workspace, PagerDuty, Palo Alto Networks, Proofpoint, SpyCloud, Tanium, Tenable, and Zscaler confirmed they were impacted, with the activity attributed to a cluster tracked as UNC6395 by Google and GRUB1 by Cloudflare.
Bottom line: Nine named security vendors were compromised through a single marketing integration, which shows that an OAuth token stolen from a third-party SaaS tool can reach Salesforce data at companies whose business is defense.

Read the original at The Hacker News ↗