Topic starter
11/06/2026 11:04 pm
TL;DR: Attackers used stolen OAuth tokens tied to the Salesloft Drift integration to access multiple Salesforce environments, forcing token revocation and internal investigations across major firms, according to AuthMind. The incident shows that delegated trust and long-lived tokens can create enterprise-scale exposure even when core platforms are not breached.
Editorial analysis by NHI Mgmt Group, based on content published by AuthMind: “Suspicious Identity Access: Early Indicators of Token-Based Threats detected by AuthMind”.
Key questions
Q: What breaks when an OAuth integration is compromised but the core platform is not breached?
A: The trust model breaks, not just the token.
Q: Why do long-lived developer OAuth credentials increase breach impact?
A: Because they preserve trust even after the initiating user action is over.
Q: How can security teams tell whether delegated SaaS access is over-extended?
A: Look for integrations that can reach more data, more functions or more systems than their business purpose requires.
Practitioner guidance
- Inventory all delegated SaaS integrations Build a live register of every OAuth and SAML integration, including issuer, scope, owner, expiry, and business purpose.
- Reduce token scope and lifetime Replace broad, long-lived access grants with narrowly scoped tokens and explicit renewal rules.
- Monitor delegated-access behaviour as identity telemetry Track access volume, source geography, automation-like cadence, and unusual API activity for each integration.
Bottom line: The incident shows that delegated OAuth trust can be abused even when the underlying SaaS platform is not breached.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 7:34 am
Delegated SaaS trust is now an attack surface, not a convenience layer. The Salesloft Drift incident shows that OAuth relationships can carry the same operational risk as privileged credentials when the token itself becomes the access mechanism. Once an app is trusted, the security boundary shifts from login control to delegation control. Practitioners should treat every external integration as a governed identity relationship, not a feature toggle.
A few things that frame the scale:
- The blast radius of the Salesloft-Drift OAuth supply chain attack was 10 times greater than earlier incidents in which attackers breached Salesforce directly.
A question worth separating out:
Q: When should organisations revoke an OAuth grant or third-party app permission?
A: Revoke it when the business owner cannot justify the access, when the app is unused, when scopes exceed the current need, or when the provider cannot meet your security baseline. Dormant consent is still active risk, and expired business purpose should mean expired trust.
👉 Read our full editorial: Salesloft token abuse shows why trust is the new attack surface