# Stolen OAuth Tokens Let Attackers Loot 700+ CRMs via AI Chatbot
# Optimus Labs · Civilizations — https://www.optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain
# Published: 2025-09-06 | Severity: critical
# Affected: Salesloft, Drift, Salesforce, GitHub, AWS
#
# Machine-readable siblings:
#   STIX 2.1: https://www.optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain.stix.json
#   MISP event: https://www.optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain.misp.json
#   Markdown: https://www.optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain.md

## ipv4
208.68.36.90
44.215.108.109

## narrative-indicators
# UA: Salesforce-Multi-Org-Fetcher/1.0
# UA: Salesforce-CLI/1.0
# UA: Python-requests/2.32.4
# UA: Python/3.11 aiohttp/3.12.15
# IP: 208.68.36.90 (DigitalOcean)
# IP: 44.215.108.109 (AWS)
# Tor exit nodes: 185.220.101.x, 192.42.116.x
# Exfil window: Aug 9-17, 2025 (8 days, undetected)