Decipher Files: The Salesloft Drift OAuth Breach and the Credentials That Kept Paying Off

Salesloft disclosed on August 20, 2025 that its Drift AI chatbot integration had been compromised, initially describing a narrow, contained incident. Google's Threat Intelligence Group (GTIG) and Palo Alto Networks' Unit 42, tracking the intrusion as UNC6395, found the opposite: between roughly August 8 and August 18, 2025, the actor used stolen OAuth and refresh tokens issued to the Drift-Salesforce integration to authenticate directly into customer Salesforce instances without needing a username, password, or MFA prompt, because the integration itself was the trusted credential.

The blast radius was unusually large for a single-vendor compromise. GTIG's tracking eventually named more than 700 affected organizations, including a cluster of cybersecurity vendors themselves: Cloudflare, Palo Alto Networks, Zscaler, Proofpoint, Tanium, and SpyCloud all confirmed exposure. The actor did not need to breach each company individually; it queried and exported Salesforce case text, contact records, and account data at scale across every tenant the stolen tokens could reach, then combed the exports for plaintext secrets, AWS keys, Snowflake tokens, and VPN credentials that customers had pasted into support tickets over the integration's lifetime.

That second-order harvesting is what turned a 10-day access window into a multi-month, multi-victim campaign. On March 12, 2026, Telus Digital confirmed a separate cybersecurity incident after the extortion group ShinyHunters claimed to have stolen nearly a petabyte of data, including business-process-outsourcing customer data and Telus consumer call records. Reporting from BleepingComputer and TechRadar traced the initial access to Google Cloud Platform login credentials the actors had recovered from the Salesloft Drift exposure, seven months earlier. Once inside Telus's GCP environment, the actor reached a BigQuery instance, downloaded it, scanned the contents for further credentials, and moved laterally. ShinyHunters demanded $65 million to withhold the data from public release; Telus refused to pay.

Three structural lessons follow, and none of them are specific to Salesloft or Telus:

First, an OAuth token is a durable credential, not a session. Unlike a password a user might rotate after a breach notice, an OAuth or refresh token issued to a third-party integration is often invisible to the end customer, has no expiry the customer controls, and keeps working until the vendor or the customer explicitly revokes it. Salesloft's own disclosure and the subsequent GTIG advisory both had to walk customers through manually re-authorizing or removing the Drift integration; there was no single kill switch. Any organization that cannot enumerate every third-party app with a live OAuth grant into its core SaaS platforms (Salesforce, Google Workspace, Microsoft 365) cannot answer "are we still exposed" after a vendor breach, only "were we exposed on the day of disclosure."

Second, credentials harvested in a breach have a shelf life measured in months, not days. The gap between the Drift compromise (August 2025) and its use against Telus (February-March 2026) was over half a year. Security teams that treat "we rotated the credentials we knew were exposed" as closing the incident are working from an incomplete list, because the attacker's own discovery process (scanning exfiltrated support tickets and case notes for secondary secrets) finds credentials the victim organization never knew were in that dataset in the first place.

Third, being a security vendor does not exempt an organization from this pattern. Cloudflare, Palo Alto Networks, Zscaler, Proofpoint, and Tanium are five of the more sophisticated security engineering organizations in the industry, and all five confirmed exposure through the same third-party chatbot integration. The lesson for practitioners is not "buy better tools," it is that third-party risk management has to extend past the vendor's own security posture to every downstream integration that vendor's product touches, including ones (a chatbot) that look low-risk on a vendor risk questionnaire.

For careers: this incident is the clearest recent case study for why "SaaS security" and "OAuth/identity governance" are becoming distinct hiring lines rather than a sub-task inside general cloud security. Third-party risk management, identity and access management, and incident response postings that specifically reference vendor-integration risk or OAuth token governance became more common in the months following disclosure.