Forest Global Training Partners

Cyber Risks · Krebs on Security

The Ongoing Fallout from a Breach at AI Chatbot Maker Salesloft

Summary: Google's Threat Intelligence Group warned that hackers tracked as UNC6395 used authentication tokens stolen from Salesloft's Drift AI chatbot to siphon data from numerous corporate Salesforce instances between August 8 and August 18, 2025, and also stole valid tokens for hundreds of integrated services including Slack, Google Workspace, Amazon S3, Microsoft Azure, and OpenAI. Salesloft, which says its products are trusted by 5,000+ customers, disclosed the Drift security issue on August 20 and urged customers to re-authenticate, while Salesforce blocked Drift from integrating with its platform, Slack, and Pardot on August 28.

Bottom line: Google advised organizations using Salesloft Drift to consider their data compromised and to immediately invalidate all tokens connected to their Salesloft integrations, regardless of the third-party service - and the attackers are now sifting that haul for AWS keys, VPN credentials, and Snowflake credentials that could let them pivot into victim and partner environments.

Read the original at Krebs on Security ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026