2025-08-20 · 2025-Q3
Salesloft Drift OAuth Supply Chain Breach
Should this run hold this key at all?
- Fixable
- Architectural
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Attacker
Target
Salesloft Drift / Salesforce / Google Workspace / Slack
Impact
700+ organizations compromised including Cloudflare, Google, Palo Alto Networks, Zscaler; CRM records, API keys, cloud credentials stolen
Root cause
UNC6395 stole OAuth tokens from Drift chatbot integration
Sources
Catalog
Cite this: AgentProv incident record: Salesloft Drift OAuth Supply Chain Breach (2025-08-20). https://agentprov.com/incidents/2025-08-20-salesloft-drift-oauth-supply-chain-breach
Related
- Also L1 · 2026-10-21LiteLLM 1.107.0 on PyPI and Docker Ships a Credential Stealer That Runs at Every Python StartupL1Credential
- Also L1 · 2026-10-17OpenCode Console Breach Exposes Users' Stored OpenAI, Anthropic, and Google API KeysL1Credential
- Also L1 · 2026-10-13IBM MCP Context Forge Shipped a Known JWT Secret, Letting Anyone Mint Platform Admin Tokens (CVE-2026-53709)L1Credential