Google warns Salesloft breach impacted some Workspace accounts

Google Threat Intelligence (Mandiant, tracked as UNC6395) disclosed that the Salesloft Drift platform was compromised via stolen OAuth tokens, enabling attackers to access customer Salesforce instances and, in a few cases, Google Workspace email accounts integrated with Drift. The actors queried Salesforce objects to harvest sensitive data (including cloud access keys and tokens) likely for further compromise or extortion; tokens have been revoked and customers are advised to rotate credentials, review integrations, and investigate connected systems.