Stolen OAuth Tokens Expose Palo Alto Customer Data
Attackers used voice phishing to link malicious OAuth apps to Salesforce, stealing tokens and exposing sensitive data from over 700 organizations, including major global companies, in August 2025.
- On August 26, Salesloft said attackers used compromised OAuth credentials to exfiltrate Salesforce data from August 8 to August 18, 2025, exploiting the Salesloft Drift integration.
- Security teams say the attackers relied on voice phishing and social engineering to trick employees who handled OAuth app links into installing malicious apps on Salesforce this year.
- Analysts warn attackers sought customer contact data and support-case content, while specifically harvesting AWS access keys and Snowflake tokens for further misuse.
- Salesloft revoked the tokens on August 20, but damage was underway; Salesforce and Google disabled Salesloft Drift integrations while over 700 customers audit and rotate credentials en masse.
- Google Threat Intelligence Group identified UNC6395 and warned last week that the campaign extended beyond Salesforce-Drift, with experts urging stronger authentication like short-lived tokens or hardware-based security for AI-vendor integrations.
Insights by Ground AI
Does this summary seem wrong?
12 Articles
12 Articles
Palo Alto Networks, Zscaler Customers Impacted By Supply Chain Attacks - Cybernoz - Cybersecurity News
Palo Alto Networks on Tuesday said it has been impacted by the Salesloft Drift supply chain incident that gave hackers access to downstream customer Salesforce data. In a blog post released Tuesday, Palo Alto Networks said the breach was limited to its customer relationship management platform and that most of the information involves business contact information, internal sales account and basic case data. “We quickly contained the incident a…
Coverage Details
Total News Sources12
Leaning Left0Leaning Right0Center3Last UpdatedBias Distribution100% Center
Bias Distribution
- 100% of the sources are Center
100% Center
C 100%
Factuality
To view factuality data please Upgrade to Premium