Recent Security Breaches Underscore Growing Cyber Threats In an alarming series of recent cyber incidents, it has become evident that some of the most significant security breaches often unfold quietly, without immediate alert signals. These breaches usually involve subtle actions that may appear innocuous, highlighting a troubling trend in which…
Cybercrime Groups ShinyHunters and Scattered Spider Unite for Targeted Extortion Campaign Against Businesses
August 12, 2025
Cybercrime / Financial Security
A continuing data extortion initiative targeting Salesforce clients may soon expand its focus to encompass financial services and tech providers, as recent findings suggest collaboration between ShinyHunters and Scattered Spider. “This latest series of attacks attributed to ShinyHunters indicates a significant tactical shift, moving past their prior methods of credential theft and database exploitation,” reports ReliaQuest to The Hacker News. Their new approach incorporates strategies akin to those used by Scattered Spider, including highly-targeted vishing (voice phishing) and social engineering tactics, the use of applications that pose as legitimate tools, and Okta-themed phishing pages to deceive victims into revealing credentials during vishing attempts, alongside VPN obfuscation for data exfiltration. ShinyHunters, which first emerged in 2020, is a financially motivated group that has executed numerous data breaches targeting major corporations.
Cybercrime Alliances: ShinyHunters and Scattered Spider Collaborate in Targeted Extortion Campaigns August 12, 2025 Cybercrime / Financial Security Recent developments reveal an alarming partnership in the cybercrime landscape, as the notorious groups ShinyHunters and Scattered Spider are joining forces to escalate extortion attacks specifically targeting businesses, including Salesforce customers. This…
Cybercrime Groups ShinyHunters and Scattered Spider Unite for Targeted Extortion Campaign Against Businesses
August 12, 2025
Cybercrime / Financial Security
A continuing data extortion initiative targeting Salesforce clients may soon expand its focus to encompass financial services and tech providers, as recent findings suggest collaboration between ShinyHunters and Scattered Spider. “This latest series of attacks attributed to ShinyHunters indicates a significant tactical shift, moving past their prior methods of credential theft and database exploitation,” reports ReliaQuest to The Hacker News. Their new approach incorporates strategies akin to those used by Scattered Spider, including highly-targeted vishing (voice phishing) and social engineering tactics, the use of applications that pose as legitimate tools, and Okta-themed phishing pages to deceive victims into revealing credentials during vishing attempts, alongside VPN obfuscation for data exfiltration. ShinyHunters, which first emerged in 2020, is a financially motivated group that has executed numerous data breaches targeting major corporations.
Salesloft OAuth Breach Through Drift AI Chat Agent Compromises Salesforce Customer Data
August 27, 2025
Cloud Security / Threat Intelligence
A significant data breach has targeted the sales automation platform Salesloft, allowing hackers to steal OAuth and refresh tokens linked to the Drift AI chat agent. This opportunistic attack has been connected to a threat group identified by Google Threat Intelligence Group (GTIG) and Mandiant, known as UNC6395. GTIG has reported over 700 potentially affected organizations. According to researchers Austin Larsen, Matt Lin, Tyler McLellan, and Omar ElAhdan, the attacks began as early as August 8, 2025, and continued until at least August 18, 2025, focusing on Salesforce customer accounts through the compromised Salesloft Drift application. The hackers have been seen exporting large volumes of data from various corporate Salesforce instances, likely in an effort to harvest credentials for further exploitation.
Salesloft OAuth Breach through Drift AI Chat Agent Affects Salesforce Customer Data August 27, 2025 In a significant cybersecurity incident, a data breach involving the sales automation service Salesloft has led to the compromise of OAuth and refresh tokens linked to the Drift artificial intelligence chat agent. This incident appears…
Salesloft OAuth Breach Through Drift AI Chat Agent Compromises Salesforce Customer Data
August 27, 2025
Cloud Security / Threat Intelligence
A significant data breach has targeted the sales automation platform Salesloft, allowing hackers to steal OAuth and refresh tokens linked to the Drift AI chat agent. This opportunistic attack has been connected to a threat group identified by Google Threat Intelligence Group (GTIG) and Mandiant, known as UNC6395. GTIG has reported over 700 potentially affected organizations. According to researchers Austin Larsen, Matt Lin, Tyler McLellan, and Omar ElAhdan, the attacks began as early as August 8, 2025, and continued until at least August 18, 2025, focusing on Salesforce customer accounts through the compromised Salesloft Drift application. The hackers have been seen exporting large volumes of data from various corporate Salesforce instances, likely in an effort to harvest credentials for further exploitation.
Google Alerts: Salesloft Drift Breach Affects All Integrations Beyond Salesforce
Aug 29, 2025
Data Breach / Salesforce
Google has issued a warning regarding the recent surge of attacks on Salesforce instances via Salesloft Drift, revealing that the scope of the breach is wider than initially believed. The advisory advises all Salesloft Drift customers to consider any authentication tokens linked to the Drift platform as potentially compromised. According to the Google Threat Intelligence Group (GTIG) and Mandiant, the attackers utilized stolen OAuth tokens to access emails from a select few Google Workspace accounts on August 9, 2025, following the breach of the OAuth tokens for the “Drift Email” integration. Importantly, this incident does not represent a compromise of Google Workspace or Alphabet itself. Only accounts specifically set up to integrate with Salesloft were at risk; other accounts on a customer’s Workspace remained secure.
Google Issues Warning on Expanded Impact of Salesloft Drift Breach August 29, 2025 In a significant cybersecurity alert, Google has disclosed that the recent attacks targeting Salesforce instances through Salesloft’s Drift platform are far-reaching, affecting all integrations beyond Salesforce. In an updated advisory, the Google Threat Intelligence Group (GTIG) alongside…
Google Alerts: Salesloft Drift Breach Affects All Integrations Beyond Salesforce
Aug 29, 2025
Data Breach / Salesforce
Google has issued a warning regarding the recent surge of attacks on Salesforce instances via Salesloft Drift, revealing that the scope of the breach is wider than initially believed. The advisory advises all Salesloft Drift customers to consider any authentication tokens linked to the Drift platform as potentially compromised. According to the Google Threat Intelligence Group (GTIG) and Mandiant, the attackers utilized stolen OAuth tokens to access emails from a select few Google Workspace accounts on August 9, 2025, following the breach of the OAuth tokens for the “Drift Email” integration. Importantly, this incident does not represent a compromise of Google Workspace or Alphabet itself. Only accounts specifically set up to integrate with Salesloft were at risk; other accounts on a customer’s Workspace remained secure.
Date: Sep 01, 2025
Category: Cybersecurity News / Hacking
In the evolving landscape of cybersecurity, threats often stem from interconnected vulnerabilities rather than isolated attacks. A single overlooked update or misused account can lead to significant breaches. This week’s updates illustrate how attackers are merging tactics, leveraging stolen access, unpatched software, and innovative methods to escalate from minor entry points to major risks. For security professionals, the takeaway is clear: the real threat often lies in the interplay of various small vulnerabilities rather than a single, major flaw.
WhatsApp Addresses Actively Exploited Vulnerability — WhatsApp has patched a security issue affecting its messaging applications for Apple iOS and macOS, which appears to have been exploited alongside a recently reported Apple flaw in targeted zero-day attacks. The vulnerability, identified as CVE-2025-55177, involves inadequate authorization for linked device synchronization messages. The Meta-owned company…
Weekly Cybersecurity Recap: WhatsApp Exploit, Docker Vulnerability, Salesforce Breach, and More In today’s interconnected digital landscape, cybersecurity incidents are increasingly characterized by a complex web of vulnerabilities rather than isolated threats. Recent events underscore the necessity for vigilance; a single overlooked update or compromised account can create a precarious situation,…
Date: Sep 01, 2025
Category: Cybersecurity News / Hacking
In the evolving landscape of cybersecurity, threats often stem from interconnected vulnerabilities rather than isolated attacks. A single overlooked update or misused account can lead to significant breaches. This week’s updates illustrate how attackers are merging tactics, leveraging stolen access, unpatched software, and innovative methods to escalate from minor entry points to major risks. For security professionals, the takeaway is clear: the real threat often lies in the interplay of various small vulnerabilities rather than a single, major flaw.
WhatsApp Addresses Actively Exploited Vulnerability — WhatsApp has patched a security issue affecting its messaging applications for Apple iOS and macOS, which appears to have been exploited alongside a recently reported Apple flaw in targeted zero-day attacks. The vulnerability, identified as CVE-2025-55177, involves inadequate authorization for linked device synchronization messages. The Meta-owned company…
Sep 08, 2025
Cybersecurity / Hacking News
Cybersecurity constantly evolves, with each week bringing fresh threats, vulnerabilities, and crucial lessons for defenders. For security and IT teams, the challenge lies in discerning which risks demand immediate attention. This digest aims to provide a straightforward briefing to help prioritize what matters most.
This week, the notable story is the Salesloft–Drift breach, where attackers compromised OAuth tokens, gaining access to Salesforce data from major tech companies. This incident underscores how fragile integrations can become critical vulnerabilities in enterprise defenses.
Additionally, we’ll discuss several high-risk CVEs currently under active exploitation, the latest strategies of advanced threat actors, and new insights on streamlining security workflows for greater efficiency. Each section delivers essential information, ensuring you stay informed and prepared without being overwhelmed.
⚡ Threat of the Week
Salesloft to Take Drift of…
Weekly Cybersecurity Update: Major Data Breach at Salesloft Linked to Drift, Ongoing Threats, and Rising Cyber Intelligence September 08, 2025 Cybersecurity / Hacking News The landscape of cybersecurity remains in constant flux, with each week bringing fresh challenges, vulnerabilities, and essential takeaways for security professionals. For IT departments, navigating these…
Sep 08, 2025
Cybersecurity / Hacking News
Cybersecurity constantly evolves, with each week bringing fresh threats, vulnerabilities, and crucial lessons for defenders. For security and IT teams, the challenge lies in discerning which risks demand immediate attention. This digest aims to provide a straightforward briefing to help prioritize what matters most.
This week, the notable story is the Salesloft–Drift breach, where attackers compromised OAuth tokens, gaining access to Salesforce data from major tech companies. This incident underscores how fragile integrations can become critical vulnerabilities in enterprise defenses.
Additionally, we’ll discuss several high-risk CVEs currently under active exploitation, the latest strategies of advanced threat actors, and new insights on streamlining security workflows for greater efficiency. Each section delivers essential information, ensuring you stay informed and prepared without being overwhelmed.
⚡ Threat of the Week
Salesloft to Take Drift of…
FBI Alerts on UNC6040 and UNC6395 Targeting Salesforce for Data Theft
September 13, 2025
Cyber Attack / Data Breach
The FBI has released a flash alert highlighting indicators of compromise linked to two cybercriminal groups, UNC6040 and UNC6395, known for their recent data theft and extortion campaigns. Both groups have been reported to target organizations’ Salesforce platforms using various initial access methods.
UNC6395 has been notably associated with a significant data theft operation in August 2025, where compromised OAuth tokens from the Salesloft Drift application were exploited. This vulnerability stemmed from a breach of Salesloft’s GitHub account between March and June 2025. In response, Salesloft has isolated the Drift infrastructure and temporarily disabled the AI chatbot application while implementing enhanced multi-factor authentication measures.
FBI Issues Alert on Cybercriminal Groups Targeting Salesforce Platforms September 13, 2025 In a concerning development, the Federal Bureau of Investigation (FBI) has issued a flash alert regarding two cybercriminal factions, referred to as UNC6040 and UNC6395, who are orchestrating a series of data theft and extortion attacks. This alert…
FBI Alerts on UNC6040 and UNC6395 Targeting Salesforce for Data Theft
September 13, 2025
Cyber Attack / Data Breach
The FBI has released a flash alert highlighting indicators of compromise linked to two cybercriminal groups, UNC6040 and UNC6395, known for their recent data theft and extortion campaigns. Both groups have been reported to target organizations’ Salesforce platforms using various initial access methods.
UNC6395 has been notably associated with a significant data theft operation in August 2025, where compromised OAuth tokens from the Salesloft Drift application were exploited. This vulnerability stemmed from a breach of Salesloft’s GitHub account between March and June 2025. In response, Salesloft has isolated the Drift infrastructure and temporarily disabled the AI chatbot application while implementing enhanced multi-factor authentication measures.
Cybersecurity Weekly Update: New Vulnerabilities and Persistent Threats This week, the cybersecurity landscape revealed alarming developments as multiple organizations fell victim to sophisticated attacks, highlighting the evolving tactics employed by cybercriminals. Notably, Fortinet disclosed a serious vulnerability affecting its FortiWeb application firewall, categorized as CVE-2025-58034. This flaw, assigned a medium…
Gainsight Reports Expanded Impact of Cyber Incident Gainsight has announced that recent suspicious activity affecting its applications has impacted more customers than initially anticipated. The company revealed that Salesforce initially identified three customers at risk, but by November 21, 2025, this list had grown significantly. While the exact number of…
