Google has revealed that the current wave of assaults focusing on Salesforce cases by way of Salesloft Drift is far broader in scope than beforehand thought, stating it impacts all integrations.
“We now advise all Salesloft Drift prospects to deal with any and all authentication tokens saved in or linked to the Drift platform as probably compromised,” Google Risk Intelligence Group (GTIG) and Mandiant stated in an up to date advisory.
The tech large stated the attackers additionally used stolen OAuth tokens to entry e-mail from a small variety of Google Workspace e-mail accounts on August 9, 2025, after compromising the OAuth tokens for the “Drift E mail” integration. It is price noting that this isn’t a compromise of Google Workspace or Alphabet itself.
“The one accounts that had been probably accessed had been those who had been particularly configured to combine with Salesloft; the actor wouldn’t have been capable of entry every other accounts on a buyer’s Workspace area,” Google added.
Following the invention, Google stated it notified impacted customers, revoked the precise OAuth tokens granted to the Drift E mail utility, and disabled the mixing performance between Google Workspace and Salesloft Drift amid ongoing investigation into the incident.
The corporate can also be urging organizations utilizing Salesloft Drift to overview all third-party integrations linked to their Drift occasion, revoke and rotate credentials for these purposes, and examine all linked techniques for indicators of unauthorized entry.
The broadening of the assault radius comes shortly after Google uncovered what it described as a widespread and opportunistic information theft marketing campaign that allowed the risk actors, an rising exercise cluster dubbed UNC6395, to leverage compromised OAuth tokens related to Salesloft Drift to focus on Salesforce cases from August 8 to 18, 2025.
Salesloft has since revealed that Salesforce has quickly disabled the Drift integration between Salesforce, Slack, and Pardot, solely to comply with it up practically three hours later, saying Salesforce has “elected to quickly disable all Salesloft integrations with Salesforce.”
“Primarily based on the investigation so far, there isn’t a proof of malicious exercise detected within the Salesloft integrations associated to the Drift incident,” it famous. “Moreover, at the moment, there are not any indications that the Salesloft integrations are compromised or in danger.”
