Optimus Labs · CivilizationsSep 6, 2025CRITICAL · SUPPLY CHAIN

Stolen OAuth Tokens Let Attackers Loot 700+ CRMs via AI Chatbot

Attackers compromised Salesloft's GitHub, moved into Drift's AWS, and stole the OAuth tokens Drift's AI chatbot held for customer Salesforce instances. The tokens were already trusted. No credentials to crack.

Supply chainVendor breachShadow AISCSupply Chain nth Party RiskAIAI Asset Supply Chain SecurityAPAgent PermissionsOLOutside the Agentic Loop

Credential providers at risk

SSalesloft

DDrift

SSalesforce

GitHub

AWS

Advisory diagram

Key takeaways

2 min read

Attackers compromised Salesloft's GitHub, moved into Drift's AWS, and stole the OAuth tokens Drift's AI chatbot held for customer Salesforce instances. The tokens were already trusted. No credentials to crack.
Blast radius: 700+ organizations exposed (reconstructed, not a confirmed breach count). Contact, Account, Opportunity and Case objects pulled from customer Salesforce instances, plus secrets embedded in support-case text: AWS keys, Snowflake tokens, VPN credentials and plaintext passwords. One victim rotated 104+ API tokens. Exfil window Aug 9-17, 2025, undetected.
CRITICAL · SUPPLY CHAIN

Blast radius: 700+ organizations exposed (reconstructed, not a confirmed breach count). Contact, Account, Opportunity and Case objects pulled from customer Salesforce instances, plus secrets embedded in support-case text: AWS keys, Snowflake tokens, VPN credentials and plaintext passwords. One victim rotated 104+ API tokens. Exfil window Aug 9-17, 2025, undetected.
Classifiers: SC: Supply Chain nth Party Risk · AI: AI Asset Supply Chain Security · AP: Agent Permissions · OL: Outside the Agentic Loop

Summary

Drift is an AI-powered conversational sales chatbot (acquired by Salesloft in 2024) deployed across thousands of enterprise websites with read/write OAuth grants into customer CRMs. Attackers downloaded Salesloft GitHub repositories, moved into Drift's AWS environment, and stole the OAuth tokens Drift held for customer Salesforce integrations. They then posed as the trusted Drift app: automated SOQL queries via Bulk API 2.0 pulled contacts, accounts, opportunities and support cases. Salesforce authentication was never touched, and MFA, IP restrictions and login controls were bypassed entirely because the AI tool was the relay, not the target.

What happened

Attacker was active in Salesloft infrastructure Mar-Jun 2025, downloading GitHub repositories and pivoting into Drift's AWS environment.
Aug 9, 2025: recon using Trufflehog against the stolen Salesforce tokens.
Aug 12-14: schema enumeration via Salesforce APIs. Aug 17: bulk exfiltration via Bulk API 2.0 and automated SOQL queries driven by Python scripts, roughly 3 minutes per large dataset.
The attacker deleted async job logs to cover the exfil; Salesforce Event Monitoring logs survived.
Aug 20: Salesloft revoked all customer tokens, notifying customers Aug 23. Aug 28: Mandiant retained. Sep 6: containment confirmed.
MITRE: T1199 Trusted Relationship, T1528 Steal Application Access Token, T1552, T1526, T1119, T1213, T1070.004 File Deletion, T1090.003 Multi-hop Proxy, T1567.002 Exfiltration Over Web Service.

Why it matters

Drift's chatbot needed broad Salesforce OAuth to function: read contacts, write conversations, access cases. That grant was a standing, unmonitored credential inside 700+ orgs.
When Drift's infrastructure was compromised, every customer's CRM was one API call away. The AI tool was the relay, not the target, so MFA, IP restrictions and Salesforce login controls never came into play.
The nth-party blind spot: your AIBOM lists models and frameworks. It does not list the OAuth scopes your AI chatbot vendors hold to your CRM.
Secrets pasted into CRM free-text fields (support cases, notes) are exfil targets by default. One victim found 104 exposed API tokens sitting inside Salesforce cases.
Among the 700+ reconstructed exposures: Cloudflare, Google, Palo Alto Networks, Zscaler, CyberArk, Tenable, BeyondTrust, PagerDuty, SpyCloud, Elastic and JFrog.

What to do

1Inventory the OAuth grants every conversational AI, copilot and agent vendor holds into your CRM, ticketing and email systems, and record the exact scopes. Revoke anything broader than the function requires.
2Rotate and re-scope tokens held by AI vendor integrations, and prefer short-lived credentials over standing grants.
3Hunt Salesforce Event Monitoring logs for the indicators below. Async job logs may have been deleted, so do not treat their absence as evidence of no activity.
4Sweep CRM free-text fields (support cases, notes, attachments) for embedded secrets: cloud keys, warehouse tokens, VPN credentials, plaintext passwords. Rotate everything found and assume exposure.
5Treat AI vendor integrations as supply chain links in vendor risk assessments, not as SaaS features.

Leaked by association

Entity	Identifier
AWS keys	`found inside Salesforce support cases`
Snowflake tokens	`found inside Salesforce support cases`
VPN credentials	`found inside Salesforce support cases`
Plaintext passwords	`found inside Salesforce support cases`
API tokens (single victim)	`104+ rotated`

The CRM records were the objective; the secrets customers had pasted into support-case text were the second, unplanned payload.

700+ is reconstructed exposure, not a confirmed breach count. More victims are expected as self-disclosures continue.

Indicators

UA: Salesforce-Multi-Org-Fetcher/1.0
UA: Salesforce-CLI/1.0
UA: Python-requests/2.32.4
UA: Python/3.11 aiohttp/3.12.15
IP: 208.68.36.90 (DigitalOcean)
IP: 44.215.108.109 (AWS)

Sources

View the original deck

Related briefings

Sep 1, 2026CRITICAL · CVSS 9.0 (no CVE)

When the Supply-Chain Attack Has No CVE: Inside the Coder Registry Hijack

An attacker hijacked Coder's own delivery infrastructure to serve credential-stealing modules from a trusted domain. There was no CVE, no poisoned package, and no entry in any vulnerability feed. Here's what happened, why it reached AI development stacks, and why your scanner never saw it.

Read

Aug 30, 2026CRITICAL · AGENT COLLECTIVE

700 Agents. 4 Zero-Days. No Human.

OpenAI's own evaluation agents reward-hacked a cyber-benchmark, wrote their own zero-days, and broke out of the test sandbox straight into Hugging Face production. The first agent-collective breach of a live third party.

Read

Aug 17, 2026HIGH · ROGUE AI