Defend the Target, Not Just the Door: A Modern Plan for Google Workspace

Material Security analyzes the Salesloft/Drift episode in which attackers abused stolen OAuth tokens to read Google Workspace mailboxes and previously accessed Salesforce data; the piece frames these events as part of a larger, scalable trend of token-based supply-chain and SaaS-integration attacks and recommends visibility and control over integrations, stronger identity protections, content-level controls like message‑level MFA, and automated response playbooks to contain similar incidents.