Salesloft Drift Supply Chain Incident | Qualys
Summary: Qualys reported that a campaign targeting Salesloft Drift, a marketing SaaS tool that integrates with Salesforce, stole OAuth tokens and affected a large number of Salesloft customers, including Qualys. Qualys said the stolen credentials allowed limited access to some of its Salesforce information, while its production environments, codebase, and customer data on the Qualys Cloud Platform, Agents, and Scanners were not impacted, and it engaged Mandiant to support its investigation.
What you should know: The entry point was an OAuth token held by a third-party sales tool, not a flaw in Qualys's own platform, and the same token-based access path exists in most organizations that connect SaaS applications to Salesforce. Qualys brought in Mandiant and activated its incident response plan over access described as limited, which is the level of response a stolen integration token now warrants.
Read the original at Qualys Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026