Google: Salesforce Attacks Stemmed From Third-Party App

Google's Threat Intelligence Group (GTIG) reported that UNC6395 abused OAuth tokens granted to the Salesloft Drift third-party app to systematically export sensitive data from multiple corporate Salesforce instances (observed Aug 8–18), harvesting AWS keys, passwords, and Snowflake tokens; Salesloft and Salesforce revoked tokens and removed the Drift app while GTIG and Mandiant published IoCs and remediation guidance urging organizations to search for exposed secrets, rotate credentials, and review Salesforce logs.