A recent advisory from Google and Mandiant has uncovered a significant data breach involving Salesforce, where the threat actor UNC6395 deployed stolen OAuth tokens to bypass Multi-Factor Authentication (MFA). Organizations are urged to take steps to protect non-human identities to prevent similar breaches.
According to the advisory from the Google Threat Intelligence Group (GTIG) and Mandiant, the breach was part of a broader data theft initiative targeting Salesforce accounts, running from August 8 to August 18, 2025. The actors behind this breach, identified as UNC6395, executed their plans without exploiting existing vulnerabilities within Salesforce’s core platform.
Utilizing Digital Access Keys
The breach was facilitated through compromised OAuth tokens from the third-party application, Salesloft Drift, which allowed the attackers to gain unauthorized access without needing passwords. OAuth tokens function as a digital key, and by manipulating these non-human identities (NHIs), the attackers effectively circumvented conventional security measures like MFA, which are designed to defend against straightforward password theft.
Once inside the Salesforce ecosystem, UNC6395 methodically extracted large quantities of data from various corporate accounts. Their objective appeared to center on gathering credentials and identifying high-value “secrets” that could serve as a launchpad for subsequent attacks.
Specifically, the attackers focused their efforts on harvesting sensitive information, including AWS access keys and tokens from Snowflake, thereby targeting customer accounts and associated user data. Notably, the advisory highlighted that Google Cloud customers were not directly affected by this wave of attacks.
Swift Countermeasures
Both companies, along with GTIG, have made efforts to notify organizations impacted by the breach. Observations made by Astrix Security highlight this incident as a reflection of a concerning trend where attackers exploit NHIs, which tend to have persistent access and elevated privileges.
Astrix also characterized this incident as a textbook example of such vulnerabilities, emphasizing that this type of attack provides a reliable avenue for data exfiltration, particularly for high-value NHIs, such as cloud infrastructure keys.
In light of the findings, organizations are advised to implement robust security protocols. GTIG recommends strengthening access controls, including limiting Connected App scopes, searching for exposed secrets within Salesforce data, rotating any compromised credentials, and introducing IP restrictions to mitigate future risks.
Jonathan Sander, Field CTO at Astrix Security, noted that this breach exemplified a conventional NHI attack strategy, where attackers exploit vulnerabilities that typically go unnoticed. He stressed that many organizations remain unaware of their NHIs, suggesting the necessity of establishing even a basic inventory of these identities to bolster security as a defensive measure.
