Topic starter
04/07/2026 7:51 pm
TL;DR: Salesloft Drift OAuth tokens were used to access Salesforce and Gmail, and WideField says the incident appears broader than the original Salesforce path, with activity tied to malicious IPs and downstream discovery of stored secrets, according to WideField Security. The breach shows that connected app trust and token retention remain weak points in identity governance.
Editorial analysis by NHI Mgmt Group, based on content published by Widefield Security: “More Salesloft Drift Compromise: Expanding to more apps than Salesforce”.
Key questions
Q: What breaks when a connected app token is stolen?
A: When a connected app token is stolen, the attacker authenticates as the app rather than as a person, so MFA and user login checks often never trigger.
Q: Why do third-party SaaS integrations increase identity risk in CRM environments?
A: They connect external applications directly to customer data, making the integration itself part of the identity attack surface.
Q: How can security teams tell whether OAuth access is too broad?
A: Look for apps that can read sensitive records, search wide data sets, or access more business functions than the integration needs.
Practitioner guidance
- Revoke all Drift connected app grants Remove every Salesloft Drift and Drift Email OAuth connection, then reauthorise only after verifying that existing tokens were actually invalidated and not merely hidden from view.
- Review third-party app inventories by downstream reach Classify each connected app by the systems it can reach, the scopes it holds, and whether it can access mail, CRM, calendar, or admin data across tenants.
- Search business applications for embedded secrets Inspect Salesforce records, cases, notes, and other SaaS content for exposed AWS keys, VPN credentials, Snowflake credentials, and similar secrets that could extend compromise.
Bottom line: The compromise shows that OAuth-connected apps can become durable access channels when token storage and revocation are weak.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/07/2026 7:55 pm
Connected-app governance is now a lifecycle control, not an onboarding control: OAuth consent creates durable delegated access that can remain dangerous long after the original business need changes. In this case, the important fact is not the app relationship itself but the failure to treat it as an identity asset with an offboarding path. Practitioners should read this as a governance problem spanning approval, monitoring, and revocation.
A few things that frame the scale:
- The blast radius of the Salesloft-Drift OAuth supply chain attack was 10 times greater than earlier incidents in which attackers breached Salesforce directly.
A question worth separating out:
Q: Should organisations prioritise token revocation or password resets after suspected compromise?
A: Token revocation usually comes first when the incident involves OAuth, refresh tokens, API keys, or other delegated access. Password resets help only if the attacker depended on interactive login. When the compromise path includes connected apps, the priority is to cut off every issued credential and consented integration before restoring user access.
👉 Read our full editorial: Salesloft Drift compromise exposes OAuth token risk across apps