OAuth token theft via Salesloft Drift to access Salesforce data

Google's threat intelligence team has warned that a coordinated campaign last month used stolen OAuth tokens from the Salesloft Drift third party application to extract large volumes of data from hundreds of Salesforce customer instances. The activity, attributed to a threat group tracked as UNC6395, took place between August 8 and August 18 and focused on harvesting credentials and other secrets that could be used to pivot into additional systems. Investigators say more than 700 organizations may have been potentially impacted.

Researchers found that attackers obtained a Salesloft token that allowed access to Drift-linked Salesforce instances and then used automation to run structured SOQL queries across many tenants. "Using a single token stolen from Salesloft, the threat actor was able to access tokens for any Drift linked organization," said Tyler McLellan, principal threat analyst at the Google Threat Intelligence Group. The actors executed queries against objects such as Cases, Accounts, Users and Opportunities, exported the results to external servers and then searched the exfiltrated data for high-value secrets, including Amazon Web Services access keys, Snowflake...