Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)
Teaser from the source
Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.
This is the RSS-feed teaser. Read the full article at the original source.
Read at pwn.watchMore on Salesforce
Other advisories
- Not ratedosv:CVE-2026-117561sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values
- Not ratedosv:CLEANSTART-2026-VC78529Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component
- Not ratedosv:CLEANSTART-2026-CV55977Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component
- HighCVE-2026-94384Amazon-connect-salesforce-lambda: fehlende Autorisierung
- Not ratedosv:CVE-2026-94384Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda
- HighCVE-2026-94384Fehlende Autorisierung in Amazon amazon-connect-salesforce-lambda vor 5.
- HighCVE-2026-15162Minnpost Object Sync for Salesforce: SQL-Injection
- HighCVE-2026-15162Das Plugin Object Sync für Salesforce ist anfällig für eine unauthentifizierte SQL-Injektion über den Parameter `wordpress_object_type` der REST-Route `/wp-json/object-sync-for-salesforce/push/`.
Other news entries
- From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for SoftwareNewsThe Hacker News
- ‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data ExfiltrationNewsSecurityWeek
- 'Salesbleed' Exploits Salesforce Agents to Enable Slack PhishingNewsDark Reading
- Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishingNewsThe Register — Security
- One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025NewsThe Hacker News
- Salesforce, ServiceNow data targeted in ‘City-Forum’ attacksNewsCSO Online
- "City-Forum" data-theft attacks target Salesforce, ServiceNow portalsNewsBleepingComputer
- Long-running Data Theft Campaign Targeting Salesforce, ServiceNowNewsDark Reading
Source: https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025
ID