Google has revealed that the current wave of assaults concentrating on Salesforce cases by way of Salesloft Drift is far broader in scope than beforehand thought, stating it impacts all integrations.
“We now advise all Salesloft Drift prospects to deal with any and all authentication tokens saved in or related to the Drift platform as doubtlessly compromised,” Google Menace Intelligence Group (GTIG) and Mandiant stated in an up to date advisory.
The tech big stated the attackers additionally used stolen OAuth tokens to entry electronic mail from a small variety of Google Workspace electronic mail accounts on August 9, 2025, after compromising the OAuth tokens for the “Drift E mail” integration. It is price noting that this isn’t a compromise of Google Workspace or Alphabet itself.
“The one accounts that had been doubtlessly accessed had been those who had been particularly configured to combine with Salesloft; the actor wouldn’t have been capable of entry some other accounts on a buyer’s Workspace area,” Google added.
Following the invention, Google stated it notified impacted customers, revoked the particular OAuth tokens granted to the Drift E mail utility, and disabled the mixing performance between Google Workspace and Salesloft Drift amid ongoing investigation into the incident.
The corporate can also be urging organizations utilizing Salesloft Drift to overview all third-party integrations related to their Drift occasion, revoke and rotate credentials for these functions, and examine all related methods for indicators of unauthorized entry.
The broadening of the assault radius comes shortly after Google uncovered what it described as a widespread and opportunistic knowledge theft marketing campaign that allowed the risk actors, an rising exercise cluster dubbed UNC6395, to leverage compromised OAuth tokens related to Salesloft Drift to focus on Salesforce cases from August 8 to 18, 2025.
Salesloft has since revealed that Salesforce has briefly disabled the Drift integration between Salesforce, Slack, and Pardot, solely to observe it up almost three hours later, saying Salesforce has “elected to briefly disable all Salesloft integrations with Salesforce.”
“Primarily based on the investigation so far, there isn’t a proof of malicious exercise detected within the Salesloft integrations associated to the Drift incident,” it famous. “Moreover, at the moment, there are not any indications that the Salesloft integrations are compromised or in danger.”
