No malware. No zero-day. Just a stack of stolen OAuth tokens — and for about ten days in August 2025, that was enough to loot the Salesforce data of hundreds of companies.
What happened
Salesloft’s Drift is a chat product that integrates with Salesforce. To do its job it holds OAuth tokens — long-lived credentials that let it query and update its customers’ Salesforce data on their behalf. In August 2025, a threat actor that Google’s Mandiant tracks as UNC6395 got hold of those tokens.
From roughly August 8 to 18, the attacker used the stolen tokens to systematically query and export records from more than 700 organizations’ Salesforce environments — a list that reportedly included Cloudflare, Google, PagerDuty, Palo Alto Networks, Proofpoint, Tanium and Zscaler. They pulled standard objects: Cases, Accounts, Users, Opportunities. And they weren’t browsing for fun — they combed the exported text for secrets: plaintext AWS keys, VPN credentials, Snowflake tokens, anything that could unlock the next system. On August 20, Salesloft and Salesforce revoked all active Drift tokens.
Why one integration became 700 breaches
The math is brutal and it’s built into how integration tokens usually work:
- Broad scope. A single token could read whole Salesforce objects, not a task-sized slice. Once you hold it, everything is in reach.
- Long life. These credentials sit around for months. A leak isn’t a moment of exposure; it’s a standing invitation until someone notices.
- Concentration. The tokens for hundreds of customers lived in one place. Compromise the integration and you compromise everyone who trusted it.
- Quiet by design. The malicious queries looked exactly like the integration’s normal traffic, so nothing screamed.
A credential that can read everything, lasts forever and lives in one big pile is not a convenience. It’s a single point of catastrophic failure.
What would have contained it
You can’t guarantee a vendor never loses a token. You can make a lost token worth far less. Scope each credential to the minimum data a task needs. Keep it short-lived and revocable in one click. And — critically — make the data itself dumber to steal: if the exported records had sensitive fields masked and secrets filtered out at the gate, the credential-harvesting phase comes up empty.
The lesson
Treat every integration token as if it will eventually leak. Scope it small, rotate it often, revoke it instantly — and never let secrets ride out in a response in plaintext.
How Sallyport changes the blast radius
Sallyport is built on exactly this stance. Vendor keys never leave our vault — they’re sealed with envelope encryption and decrypted only in memory, per request. Callers and integrations get scoped, revocable Sallyport tokens instead, each limited to a role’s rights. Responses are filtered and masked on the way out, so a token can’t be used to vacuum up fields it has no business seeing. A stolen Sallyport token opens a room, not the building — and you can slam that room shut the moment you notice, without rotating credentials across every downstream system.