Notifications
Clear all
Topic starter
02/08/2026 12:26 pm
TL;DR: OAuth token theft in the Salesloft Drift supply-chain campaign continues to expose Salesforce data at Qualys and Tenable, underscoring that stolen tokens can remain operational long enough to reveal customer support records and that detection lags when integrations are silently trusted, according to Anomali. The issue is not just compromise, but the governance assumption that third-party access stays visible, bounded, and reviewable in time to matter.
NHIMG editorial — based on content published by Anomali covering the Salesloft Drift breach and related cyber threats
By the numbers:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
Questions worth separating out
Q: What breaks when a stolen OAuth token is used against a trusted integration?
A: The trust model breaks because the system still sees a valid credential, even though the actor behind it is no longer trustworthy.
Q: Why do OAuth-based NHI attacks complicate incident response?
A: Because the access path is distributed across multiple services, owners, and logs.
Q: How do teams know whether OAuth token governance is actually working?
A: Look for short token lifetimes, tested revocation, no tokens in logs, and a clean mapping from each integration to an accountable owner.
Practitioner guidance
- Audit all third-party OAuth grants Inventory every connected app, map the APIs and data sets it can reach, and identify which grants can read customer, support, or administrative records.
- Revoke and rotate on a live incident timeline When token theft is suspected, revoke related OAuth credentials immediately, then review adjacent integrations that share the same tenant, consent path, or service owner.
- Log and alert on API behaviour, not just sign-ins Create detections for unusual app-to-API patterns, atypical request volume, and access from integrations that rarely touch the affected records.
What's in the full analysis
Anomali's full article covers the operational detail this post intentionally leaves for the source:
- The specific incident timeline across Salesloft, Qualys, and Tenable, including what each organisation confirmed and when.
- The full analyst commentary on why OAuth token abuse makes victim identification slower than password-based compromise.
- The incident-response details around integration shutdowns, token revocation, and partner investigation steps.
- The broader Anomali watchlist context covering related phishing and malware activity from the same period.
👉 Read Anomali's Cyber Watch coverage of the Salesloft Drift breach and related threats →
Salesloft Drift OAuth token abuse: what IAM teams need to act on?
Explore further
02/08/2026 1:25 pm
Delegated OAuth access is now a first-class NHI risk: The Salesloft Drift campaign shows that machine-to-machine trust can fail without any password theft or MFA bypass. Once a token is issued, the attacker operates inside a pre-authorised access path that many IAM teams still treat as lower priority than human accounts. The practical conclusion is that OAuth grants must be governed as live credentials, not static app settings.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to The State of Secrets Sprawl 2026.
- 28% of secrets incidents now originate outside code repositories and are 13% more likely to be categorised as critical than code-based leaks.
A question worth separating out:
Q: Who is accountable when a SaaS integration exposes customer data?
A: Accountability sits with the organisation that owns the delegated access path, even if the token originated from a third-party service. Security, application, and SaaS owners all need a defined revocation process and an incident playbook. If the integration can reach customer data, it must be governed like any other privileged identity.
👉 Read our full editorial: Salesloft Drift token abuse expands the NHI governance gap
