Salesloft Drift OAuth breach — Chinese actor UNC6395 accesses 700+ Salesforce CRM environments
Date: 2025-08
Affected: 700+ organizations including Cloudflare, Google, Palo Alto Networks — Salesforce CRM data
Attack vector: auth-bypass
Category: real-world
Severity: Critical

Chinese threat actor UNC6395 stole OAuth tokens from Salesloft's Drift AI Chat agent integration to access Salesforce CRM environments across 700+ organizations including Cloudflare, Google, Palo Alto Networks, Proofpoint, and Zscaler. Automated SOQL queries exported contacts, support cases, and account data including plaintext AWS keys and VPN credentials.

Impact: Mass enterprise data breach; plaintext credential exposure; supply chain cascade

Mitigations:
CRM data access auditing and anomaly detection
OAuth token rotation and monitoring
Third-party integration security audits

Architectural layers (MAESTRO):
label: Agent Ecosystem
notes: OAuth tokens stolen from third-party AI chat integration
role: origin
label: Data Operations
notes: CRM data including plaintext credentials exfiltrated from 700+ orgs
role: impact