Threat Brief: Salesloft Drift Integration Used To Compromise Salesforce Instances
Summary: Unit 42 observed a threat actor using compromised OAuth credentials to exfiltrate data from customers' Salesforce environments through the Salesloft Drift integration between August 8 and 18, 2025, pulling mass data from Account, Contact, Case and Opportunity records. The actor then scanned the stolen data for credentials and deleted queries to hide evidence of its jobs, while Salesloft revoked all active access and refresh tokens for the Drift application and notified affected customers.
Key Takeaway: The actor used a valid Python aiohttp user agent string with Salesforce's Bulk API to pull high volumes of data quickly, so logins carrying Python/3.11 aiohttp/3.12.15 are the trace to hunt for - and the stolen records are now being mined for credentials that feed further attacks.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026