Skip to main content
See every side of every news story
Published loading...Updated

Stolen OAuth Tokens Expose Palo Alto Customer Data

Attackers used voice phishing to link malicious OAuth apps to Salesforce, stealing tokens and exposing sensitive data from over 700 organizations, including major global companies, in August 2025.

  • On August 26, Salesloft said attackers used compromised OAuth credentials to exfiltrate Salesforce data from August 8 to August 18, 2025, exploiting the Salesloft Drift integration.
  • Security teams say the attackers relied on voice phishing and social engineering to trick employees who handled OAuth app links into installing malicious apps on Salesforce this year.
  • Analysts warn attackers sought customer contact data and support-case content, while specifically harvesting AWS access keys and Snowflake tokens for further misuse.
  • Salesloft revoked the tokens on August 20, but damage was underway; Salesforce and Google disabled Salesloft Drift integrations while over 700 customers audit and rotate credentials en masse.
  • Google Threat Intelligence Group identified UNC6395 and warned last week that the campaign extended beyond Salesforce-Drift, with experts urging stronger authentication like short-lived tokens or hardware-based security for AI-vendor integrations.
Insights by Ground AI
Does this summary seem wrong?

12 Articles

Think freely.Subscribe and get full access to Ground NewsSubscriptions start at $9.99/yearSubscribe

Bias Distribution

  • 100% of the sources are Center
100% Center

Factuality 

To view factuality data please Upgrade to Premium

Ownership

To view ownership data please Upgrade to Vantage

Heise broke the news in Germany on Monday, September 1, 2025.
Sources are mostly out of (0)
News
For You
Search
BlindspotLocal