Trusted Connections, Hidden Risks: Token Management in the Third-Party Supply Chain
Summary: Unit 42 describes a scenario in which a stolen OAuth token tied to a dormant third-party Salesforce integration makes hundreds of connections from three IP addresses, two flagged as an unknown VPN service, as the attacker enumerates CRM accounts and exfiltrates data. The article cites the 2025 Salesloft Drift incident, in which threat actor UNC6395 stole an OAuth token to bypass MFA and gained persistent access to hundreds of customer Salesforce instances, along with earlier token exposures at GitHub (2022), CircleCI (2023) and the Internet Archive (2024).
Key Takeaway: In the Internet Archive breach, GitLab tokens stayed valid for 22 months and attackers exfiltrated 7 TB of data; in the Salesloft Drift case, one stolen token reached hundreds of customer Salesforce instances without triggering MFA.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026