Notifications
Clear all
Topic starter
22/08/2026 12:00 pm
TL;DR: OAuth tokens tied to the Salesloft Drift integration enabled attackers to exfiltrate Salesforce data from multiple organisations, including Palo Alto Networks, Zscaler, and PagerDuty, according to AccuKnox’s analysis of the breach and Google Threat Intelligence Group findings. The incident shows that third-party OAuth trust can become a credential harvesting channel when lifecycle controls, visibility, and revocation are weak.
NHIMG editorial — based on content published by AccuKnox covering the Salesloft Drift supply chain breach: Major cybersecurity vendors breached in widespread data theft campaign
By the numbers:
- Salesloft Drift was linked to a coordinated campaign that ran between August 8 and August 18, 2025.
- Attackers attempted access to publicly exposed AWS credentials within an average of 17 minutes, and as quickly as 9 minutes in some cases.
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone.
Questions worth separating out
Q: What breaks when third-party OAuth integrations are over-scoped?
A: Over-scoped integrations turn delegated access into an attacker-controlled session with too much reach.
Q: Why do SaaS supply chain breaches often lead to credential theft?
A: Because the first compromise usually exposes more than records.
Q: What do security teams get wrong about OAuth refresh tokens?
A: They often assume a refresh token will keep working after scopes change or that it will be reissued automatically.
Practitioner guidance
- Map every third-party OAuth grant Identify all SaaS integrations with delegated access, then document scopes, owners, expiry, and revocation path.
- Shorten token lifetime and enforce offboarding Remove standing OAuth grants that do not have a current business need, and make revocation part of application offboarding rather than incident response.
- Scan SaaS content for embedded secrets Search records, attachments, tickets, and messages for API keys, passwords, and cloud tokens, then route findings into secret rotation workflows instead of simple alerting.
What's in the full article
AccuKnox's full blog covers the operational detail this post intentionally leaves for the source:
- A step-by-step breakdown of how the Salesloft Drift compromise unfolded across Salesforce-connected environments.
- Specific control examples for ASPM, secret scanning, and runtime policy enforcement in CNAPP workflows.
- Illustrative prevention patterns for exposed AWS keys, token abuse, and process-based network controls.
- Vendor examples of how Zero Trust policies map to multi-cloud enforcement and admission control.
👉 Read AccuKnox's analysis of the Salesloft Drift supply chain breach →
Salesloft Drift supply chain breach: what IAM teams missed?
Explore further
22/08/2026 12:01 pm
Trusted SaaS integrations have become NHI governance assets, not just application connectors. When an OAuth token can act with broad delegated authority, it behaves like a non-human identity and should be governed with the same lifecycle discipline as any other privileged credential. This is where IAM and NHI governance converge most sharply. Practitioner conclusion: treat third-party app grants as managed identities with explicit scope, expiry, and revocation controls.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to The State of Secrets Sprawl 2026.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
A question worth separating out:
Q: Who is accountable when a SaaS integration exposes customer data?
A: Accountability sits with the organisation that owns the delegated access path, even if the token originated from a third-party service. Security, application, and SaaS owners all need a defined revocation process and an incident playbook. If the integration can reach customer data, it must be governed like any other privileged identity.
👉 Read our full editorial: Salesloft Drift breach exposes the limits of SaaS trust
