Salesforce Data Breach: Hackers Drift into Trouble with OAuth Token Tactics!
Hackers stole data from hundreds of Salesforce customer instances, warns Google Threat Intelligence Group. The culprits didn’t break into Salesforce itself but sweet-talked their way in with compromised OAuth tokens for Salesloft Drift, an AI chat bot. If you integrated Drift with Salesforce, consider your data compromised, and start changing those passwords like it’s 1999!
Hot Take:
Well, well, well, looks like Salesforce customers got a not-so-friendly visit from hackers with a PhD in OAuth token pilfering. Who knew AI chatbots could moonlight as data thieves? If this were a movie, it’d be called “The Great Salesforce Heist: Drift into Danger”.
Key Points:
- Hackers exploited compromised OAuth tokens for the Drift chatbot, not a Salesforce vulnerability.
- The incident affected around 700 Salesforce customers but only those using the Drift integration.
- UNC6395, the threat actor, was after credentials and sensitive data like AWS keys and passwords.
- Salesloft revoked the compromised tokens and shared indicators of compromise (IOCs).
- Salesforce removed Drift from AppExchange and notified affected customers.
Already a member? Log in here