Wake-Up Call for SaaS Integration Security

September 18th, 2025 - Written By Cyber Labs Services

In August 2025, the cybersecurity community was shaken by one of the most significant SaaS supply-chain breaches to date. A single compromised integration between Salesloft’s Drift chatbot and Salesforce exposed over 700 organizations to unauthorized access, data theft, and potential system compromise. This incident underscores the critical need for robust security measures in third-party integrations and highlights the vulnerabilities inherent in modern enterprise ecosystems.

Understanding the Attack

The breach began in early August 2025 when threat actors identified as UNC6395 (also known as “GRUB1”) exploited OAuth tokens associated with the integration between Drift—a conversational marketing platform acquired by Salesloft in 2024—and Salesforce CRM. OAuth tokens allow trusted, token-based authorization for integrations without exposing user passwords.

By stealing these OAuth and refresh tokens, attackers impersonated trusted users with extensive access to Salesforce environments across hundreds of organizations. Using Python automation tools and Salesforce’s Bulk API, they covertly exported large volumes of data between August 8 and 18, 2025. Extracted data included:

Customer contact information
Support case details
Account records
Embedded secrets, such as AWS keys and plaintext passwords stored in Salesforce fields

The attackers focused on silent data harvesting rather than ransom demands, evading detection for nearly six months after an initial GitHub breach at Salesloft in March 2025 granted unauthorized access to AWS-hosted Drift resources.

Impact of the Breach

The attack affected a wide array of organizations-from major cybersecurity firms to mid-sized enterprises-who relied on Salesforce and Drift integrations. Beyond Salesforce, some OAuth tokens also provided access to other integrated platforms, including Google Workspace and Slack, significantly broadening the potential attack surface.

Key Learnings

Vigilant Monitoring and Logging: Organizations must deploy robust monitoring and logging to detect unauthorized access promptly.
Regular Credential Rotation: Periodically rotating OAuth tokens and other credentials can reduce the risk of token theft.
Least Privilege Access: Integrations should operate with the minimum required permissions to limit potential damage during breaches.
Third-Party Risk Management: Assessing the security posture of vendors and integrations is critical to mitigate potential vulnerabilities.

The Salesloft-Drift breach is a cautionary tale of how a single compromised SaaS integration, through abused OAuth tokens, can destabilize hundreds of enterprises and expose vast troves of sensitive data. The incident highlights the urgent need for rigorous OAuth management, zero trust principles in SaaS integrations, and sustained efforts to secure cloud supply chains.

Organizations must abandon “set and forget” integration assumptions and embrace continuous evaluation, monitoring, and incident preparedness to defend this critical security frontier.

References