Attackers Breach 700 Orgs via CX Platforms

🔑 Key Takeaways

• •Attackers compromised Salesloft’s GitHub in August 2025, stealing Drift OAuth tokens that granted access to Salesforce instances in over 700 organizations including Cloudflare and Zscaler[1][2][3].
• •No malware was deployed; attackers scanned stolen data for sensitive credentials like AWS keys, Snowflake tokens, customer contacts, and opportunity information, then pivoted to Google Workspace[1][2].
• •Persistent 'zombie' OAuth tokens from ended campaigns remained active for months, enabling lateral movement across trust domains without detection[1][3].

🛠️ Technical Deep Dive

• •OAuth tokens from Salesloft-Drift integration allowed persistent access surviving password resets and MFA, exploiting consent phishing-like broad permissions[1].
• •Attackers exported structured data (contacts, opportunities) and credentials (AWS keys, Snowflake tokens) via legitimate API calls blending with normal activity[1][4].
• •Behavioral detection baselines user-app-data relationships to spot first-time resource access by tokens; traditional CASB/SIEM miss SaaS-to-SaaS lateral movement[1][4].
• •Supply chain cascade: Compromise in one integration (Salesloft GitHub) propagated to Salesforce and Google Workspace without vendor-shared responsibility covering customer integrations[1][4].
• •Google Threat Intelligence revoked Drift Email OAuth tokens on August 28, 2025, after confirming Workspace access; average compromise time 9 minutes vs. weeks for detection[1].

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline