In August 2025, an actor tracked as UNC6395 used stolen OAuth and refresh tokens from the Salesloft Drift integration to extract data from Salesforce customer instances.
The vulnerability or weakness
The vulnerability involved compromised OAuth and refresh tokens, which allowed the actor to access Salesforce data without direct user interaction. No specific CVE ID was provided.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
More than 700 organizations were impacted, leading to potential data breaches, legal issues, and reputational damage.
Industries affected
Not stated in the sources.
Users affected
Customers of affected organizations could have their data exposed, leading to privacy concerns and potential financial loss.
