Notifications
Clear all
Topic starter
27/06/2026 2:01 pm
TL;DR: UNC6395 abused OAuth tokens tied to Salesloft’s Drift app to query Salesforce data across 700+ organisations and harvested secrets from Cases, including AWS keys, Snowflake tokens, VPN credentials, and passwords, according to Abnormal AI. Trusted integrations can become persistent access paths that bypass gateway controls and credential-based defences until tokens are revoked.
NHIMG editorial — based on content published by Abnormal AI covering the Salesloft Drift OAuth abuse campaign: Key Insights UNC6395 abused OAuth tokens tied to Salesloft's Drift app to query Salesforce data across 700+ organizations
By the numbers:
- Over 700 companies were impacted, including some of the world’s most prominent cybersecurity vendors.
- Cloudflare later disclosed that 104 API tokens were stolen from their Salesforce Case system.
Questions worth separating out
Q: What breaks when OAuth tokens are not governed like credentials?
A: When OAuth tokens are treated as convenience links instead of governed credentials, they become persistent access paths that bypass phishing controls, password resets, and inbox inspection.
Q: Why do third-party SaaS integrations increase breach impact?
A: Third-party integrations expand breach impact because one stolen token can reach multiple tenants, objects, and downstream services.
Q: How do security teams know if SaaS integrations are overprivileged?
A: The clearest signal is an integration that still has access but no active business justification, especially when its scopes are broad, its owner is unclear, or its last use is stale.
Practitioner guidance
- Inventory all third-party OAuth grants Map every SaaS integration to its scopes, business owner, and last-used date, then remove anything that cannot justify ongoing access to Salesforce, email, or downstream cloud services.
- Review support-case handling for secret leakage Block or redact AWS keys, Snowflake tokens, VPN credentials, and passwords from support workflows, and alert on bulk searches or exports from case objects.
- Correlate SaaS, email, and identity logs Detect suspicious delegated access by joining OAuth activity, mailbox access, and admin events so revoked tokens and anomalous API use can be identified together.
What's in the full article
Abnormal AI's full analysis covers the operational detail this post intentionally leaves for the source:
- The campaign timeline and investigation sequence across Salesloft, Salesforce, and Google Workspace.
- The exact query patterns used against Salesforce objects, including the Cases focus and attempted log cleanup.
- The customer impact discussion for organisations that disclosed stolen tokens and support data.
- The defensive positioning around behavioural AI, account takeover protection, and SaaS posture management.
👉 Read Abnormal AI's analysis of the Salesloft Drift OAuth abuse campaign →
Salesloft Drift OAuth abuse: what it means for IAM teams?
Explore further
27/06/2026 3:35 pm
OAuth trust is a credential problem, not just an integration problem: The Drift campaign worked because delegated access was treated as a convenience feature instead of a governed credential path. Once a third-party token can query Salesforce and email data, the organisation has created standing access that outlives the user action that authorised it. For NHI governance, the lesson is that application tokens must be managed as live identities with explicit lifecycle and revocation ownership.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation, according to Guide to the Secret Sprawl Challenge.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who is accountable when a trusted integration is abused?
A: Accountability sits with the team that approved, owned, and failed to retire the grant, not just the vendor whose token was stolen. For SaaS and NHI governance, delegated access needs an explicit owner, a lifecycle record, and a revocation path, or the organisation has no defensible control boundary.
👉 Read our full editorial: Salesloft Drift OAuth abuse shows how SaaS trust can collapse
