Salesloft OAuth Breach Through Drift AI Chat Agent Compromises Salesforce Customer Data

August 27, 2025
Cloud Security / Threat Intelligence

A significant data breach has targeted the sales automation platform Salesloft, allowing hackers to steal OAuth and refresh tokens linked to the Drift AI chat agent. This opportunistic attack has been connected to a threat group identified by Google Threat Intelligence Group (GTIG) and Mandiant, known as UNC6395. GTIG has reported over 700 potentially affected organizations. According to researchers Austin Larsen, Matt Lin, Tyler McLellan, and Omar ElAhdan, the attacks began as early as August 8, 2025, and continued until at least August 18, 2025, focusing on Salesforce customer accounts through the compromised Salesloft Drift application. The hackers have been seen exporting large volumes of data from various corporate Salesforce instances, likely in an effort to harvest credentials for further exploitation.

Salesloft OAuth Breach through Drift AI Chat Agent Affects Salesforce Customer Data

August 27, 2025

In a significant cybersecurity incident, a data breach involving the sales automation service Salesloft has led to the compromise of OAuth and refresh tokens linked to the Drift artificial intelligence chat agent. This incident appears to be part of a larger data theft campaign attributed to a threat actor designated as UNC6395 by both the Google Threat Intelligence Group (GTIG) and Mandiant. According to insights shared with The Hacker News, over 700 organizations may have been affected by this breach.

The attack is reported to have commenced around August 8, 2025, and persisted until at least August 18, 2025. During this period, the actor specifically focused on Salesforce customer instances through the exploitation of compromised OAuth tokens associated with the Salesloft Drift application.

As a result of these attacks, large volumes of sensitive data have been extracted from numerous corporate Salesforce accounts. The primary motivation behind these actions appears to be the harvesting of credentials, which could subsequently facilitate further breaches within the affected organizations.

The operational tactics employed in this breach align closely with several strategies outlined in the MITRE ATT&CK Framework. Initial access was likely obtained through the exploitation of OAuth tokens, illustrating a sophisticated approach to gaining entry into protected environments. Following the breach, the actor may have employed techniques related to data exfiltration, which underscore the importance of robust access controls and monitoring systems for organizations utilizing third-party applications.

This breach raises crucial questions for businesses, particularly those relying on interoperability between sales platforms and third-party AI solutions. The risks associated with such integrations cannot be overstated, and companies are urged to conduct thorough reviews of their security postures to mitigate potential vulnerabilities.

As this incident unfolds, the implications for affected organizations may be profound. Cybersecurity professionals are reminded of the importance of vigilance and proactive response strategies in safeguarding sensitive customer information against increasingly sophisticated cyber threats. Through understanding and addressing the tactics used by attackers, businesses can enhance their defenses and better protect their assets in a rapidly evolving threat landscape.

Source link

Related Posts

ShadowSilk Targets 35 Organizations Across Central Asia and APAC via Telegram Bots

August 27, 2025
Malware / Spyware

A threat cluster known as ShadowSilk is responsible for a new wave of attacks aimed at government entities in Central Asia and the Asia-Pacific region. Group-IB has identified nearly 35 victims, primarily focused on data exfiltration. This hacking group shares tools and infrastructure with other threat actors, including YoroTrooper, SturgeonPhisher, and Silent Lynx. The affected organizations are predominantly government bodies, with some incidents involving the energy, manufacturing, retail, and transportation sectors across Uzbekistan, Kyrgyzstan, Myanmar, Tajikistan, Pakistan, and Turkmenistan. “The operation is executed by a bilingual team—Russian-speaking developers linked to older YoroTrooper code and Chinese-speaking operatives leading the intrusions—creating a versatile, multi-regional threat,” state researchers Nikita Rostovcev and Sergei Turner.

Anthropic Unveils Disruption of AI-Driven Cyberattacks Targeting Key Sectors for Data Theft and Extortion

Date: August 27, 2025
Categories: Cybersecurity / Artificial Intelligence

On Wednesday, Anthropic announced the successful disruption of a sophisticated cyber operation that leveraged its AI-powered chatbot, Claude, for extensive data theft and extortion activities in July 2025. “The perpetrator targeted at least 17 distinct organizations, including those in healthcare, emergency services, government, and religious sectors,” the company reported. Instead of using traditional ransomware to encrypt stolen information, the actor threatened to publicly disclose the data, attempting to coerce victims into paying hefty ransoms—sometimes exceeding $500,000. The attacker reportedly utilized Claude Code on Kali Linux as a comprehensive attack platform, embedding operational instructions in a CLAUDE.md file that maintained ongoing context for each interaction. This unknown threat actor is said to have employed AI with an “unprecedented degree,” utilizing Claude Code, Anthropic’s agentic coding tool, to automate various aspects of the attack.

Storm-0501 Exploits Entra ID for Azure Data Exfiltration and Deletion in Hybrid Cloud Attacks

August 27, 2025
Ransomware / Cloud Security

The financially motivated threat actor known as Storm-0501 has been observed enhancing its tactics to carry out data exfiltration and extortion attacks in cloud environments. “Unlike traditional on-premises ransomware that relies on deploying malware to encrypt essential files across compromised network endpoints and negotiating for a decryption key, cloud-based ransomware represents a significant change,” noted the Microsoft Threat Intelligence team in a report shared with The Hacker News. “Utilizing cloud-native capabilities, Storm-0501 swiftly exfiltrates substantial data volumes, deletes data and backups within the victim’s environment, and demands ransom—all without conventional malware deployment.” Storm-0501 was initially documented by Microsoft nearly a year ago, focusing on its hybrid cloud ransomware attacks against sectors such as government, manufacturing, transportation, and law enforcement in the U.S.

U.S. Treasury Imposes Sanctions on North Korean IT Worker Scheme, Uncovering $600K in Crypto Transfers and Over $1M in Profits

August 28, 2025
Artificial Intelligence / Malware

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has announced new sanctions against two individuals and two entities linked to North Korea’s remote IT worker scheme, which generates illicit revenue for the regime’s weapons of mass destruction and ballistic missile initiatives. “The North Korean regime continues to exploit American businesses through fraudulent schemes involving overseas IT workers who steal data and extort ransom,” stated John K. Hurley, Under Secretary of the Treasury for Terrorism and Financial Intelligence. “Under President Trump’s administration, the Treasury remains dedicated to safeguarding Americans from these schemes and holding those responsible accountable.” Key individuals targeted include Vitaliy Sergeyevich Andreyev, Kim Ung Sun, Shenyang Geumpungri Network Technology Co., Ltd, and Korea Sinjin Trading Corporation. This initiative broadens the sanctions previously imposed on Chinyong Informat…