Attack + Goal
August 2025 on Salesloft and Drift AI integration; goal was broad corporate data theft and credential harvesting.
Result
Over 700 enterprise Salesforce databases breached, exposing sensitive customer records, cloud keys, and access passwords.
Method
Stolen OAuth tokens and API access keys harvested from Drift AI application connections to bypass security perimeters.
Financial Impact
Unquantified overall cost; extensive damages from token revocations, forensic responses, API resets, and downstream exposures.
In August 2025, attackers breached Salesloft, impacting over 700 organizations connected to its Drift service. The blast radius reached major technology companies and corporate sales networks nationwide. The intrusion relied entirely on credential theft, as hackers stole digital access keys connecting Drift to customer database accounts. These stolen credentials allowed attackers to bypass security boundaries without needing user passwords. The threat actors searched customer databases and extracted corporate sales files, customer records, and administrative passwords. To stop further damage, system providers severed thousands of connected accounts and temporarily removed the app from digital marketplaces. This forced affected businesses to launch emergency security reviews, reset access keys, and assess exposed consumer information.
DarkArmor detects exposed OAuth tokens tied to your integrations right when it is collected by the threat actor, providing a remediation window before they're used to pull data from connected instances.
