{
  "@context": "https://schema.org",
  "@type": "Report",
  "url": "https://www.optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain",
  "identifier": "salesloft-drift-oauth-supply-chain",
  "headline": "Stolen OAuth Tokens Let Attackers Loot 700+ CRMs via AI Chatbot",
  "name": "Stolen OAuth Tokens Let Attackers Loot 700+ CRMs via AI Chatbot",
  "abstract": "Attackers compromised Salesloft's GitHub, moved into Drift's AWS, and stole the OAuth tokens Drift's AI chatbot held for customer Salesforce instances. The tokens were already trusted. No credentials to crack.",
  "description": "Drift is an AI-powered conversational sales chatbot (acquired by Salesloft in 2024) deployed across thousands of enterprise websites with read/write OAuth grants into customer CRMs. Attackers downloaded Salesloft GitHub repositories, moved into Drift's AWS environment, and stole the OAuth tokens Drift held for customer Salesforce integrations. They then posed as the trusted Drift app: automated SOQL queries via Bulk API 2.0 pulled contacts, accounts, opportunities and support cases. Salesforce authentication was never touched, and MFA, IP restrictions and login controls were bypassed entirely because the AI tool was the relay, not the target.",
  "datePublished": "2025-09-06",
  "dateModified": "2025-09-06",
  "inLanguage": "en",
  "isAccessibleForFree": true,
  "author": {
    "@type": "Organization",
    "name": "Optimus Labs · Civilizations",
    "url": "https://www.optimuslabs.io/research/briefings"
  },
  "publisher": {
    "@type": "Organization",
    "name": "Optimus Labs",
    "url": "https://www.optimuslabs.io"
  },
  "keywords": [
    "Salesloft",
    "Drift",
    "Salesforce",
    "GitHub",
    "AWS",
    "Supply chain",
    "Vendor breach",
    "Shadow AI",
    "Supply Chain nth Party Risk",
    "AI Asset Supply Chain Security",
    "Agent Permissions",
    "Outside the Agentic Loop",
    "agentic AI security",
    "AI agent supply chain"
  ],
  "about": [
    {
      "@type": "Thing",
      "name": "Salesloft"
    },
    {
      "@type": "Thing",
      "name": "Drift"
    },
    {
      "@type": "Thing",
      "name": "Salesforce"
    },
    {
      "@type": "Thing",
      "name": "GitHub"
    },
    {
      "@type": "Thing",
      "name": "AWS"
    }
  ],
  "citation": [
    {
      "@type": "CreativeWork",
      "name": "Anomali — chain analysis with MITRE mapping",
      "url": "https://www.anomali.com/blog/salesloft-drift-breach-recap"
    },
    {
      "@type": "CreativeWork",
      "name": "UpGuard — breach analysis, victim list, 700+ orgs",
      "url": "https://www.upguard.com/blog/salesloft-drift-breach"
    },
    {
      "@type": "CreativeWork",
      "name": "SOCRadar — disclosure analysis and exposed data inventory",
      "url": "https://socradar.io/blog/salesloft-drift-breach-everything-you-need-to-know"
    },
    {
      "@type": "CreativeWork",
      "name": "ProcessUnity — third-party risk lessons",
      "url": "https://www.processunity.com/resources/blogs/lessons-from-drift-salesloft-breach"
    },
    {
      "@type": "CreativeWork",
      "name": "FINRA — regulatory alert",
      "url": "https://www.finra.org/rules-guidance/guidance/salesloft-drift-AI-supply-chain-attack"
    }
  ],
  "encoding": [
    {
      "@type": "MediaObject",
      "encodingFormat": "text/markdown",
      "contentUrl": "https://www.optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain.md"
    },
    {
      "@type": "MediaObject",
      "encodingFormat": "application/json",
      "contentUrl": "https://www.optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain.json"
    }
  ],
  "additionalProperty": [
    {
      "@type": "PropertyValue",
      "name": "severity",
      "value": "CRITICAL · SUPPLY CHAIN"
    },
    {
      "@type": "PropertyValue",
      "name": "blastRadius",
      "value": "700+ organizations exposed (reconstructed, not a confirmed breach count). Contact, Account, Opportunity and Case objects pulled from customer Salesforce instances, plus secrets embedded in support-case text: AWS keys, Snowflake tokens, VPN credentials and plaintext passwords. One victim rotated 104+ API tokens. Exfil window Aug 9-17, 2025, undetected."
    }
  ],
  "briefing": {
    "slug": "salesloft-drift-oauth-supply-chain",
    "number": 9,
    "title": "Stolen OAuth Tokens Let Attackers Loot 700+ CRMs via AI Chatbot",
    "dek": "Attackers compromised Salesloft's GitHub, moved into Drift's AWS, and stole the OAuth tokens Drift's AI chatbot held for customer Salesforce instances. The tokens were already trusted. No credentials to crack.",
    "date": "2025-09-06",
    "severity": "critical",
    "severityLabel": "CRITICAL · SUPPLY CHAIN",
    "types": [
      "supply-chain",
      "vendor-breach",
      "shadow-ai"
    ],
    "categories": [
      "SC",
      "AI",
      "AP",
      "OL"
    ],
    "vendors": [
      "Salesloft",
      "Drift",
      "Salesforce",
      "GitHub",
      "AWS"
    ],
    "blastRadius": "700+ organizations exposed (reconstructed, not a confirmed breach count). Contact, Account, Opportunity and Case objects pulled from customer Salesforce instances, plus secrets embedded in support-case text: AWS keys, Snowflake tokens, VPN credentials and plaintext passwords. One victim rotated 104+ API tokens. Exfil window Aug 9-17, 2025, undetected.",
    "summary": "Drift is an AI-powered conversational sales chatbot (acquired by Salesloft in 2024) deployed across thousands of enterprise websites with read/write OAuth grants into customer CRMs. Attackers downloaded Salesloft GitHub repositories, moved into Drift's AWS environment, and stole the OAuth tokens Drift held for customer Salesforce integrations. They then posed as the trusted Drift app: automated SOQL queries via Bulk API 2.0 pulled contacts, accounts, opportunities and support cases. Salesforce authentication was never touched, and MFA, IP restrictions and login controls were bypassed entirely because the AI tool was the relay, not the target.",
    "whatHappened": [
      "Attacker was active in Salesloft infrastructure Mar-Jun 2025, downloading GitHub repositories and pivoting into Drift's AWS environment.",
      "Aug 9, 2025: recon using Trufflehog against the stolen Salesforce tokens.",
      "Aug 12-14: schema enumeration via Salesforce APIs. Aug 17: bulk exfiltration via Bulk API 2.0 and automated SOQL queries driven by Python scripts, roughly 3 minutes per large dataset.",
      "The attacker deleted async job logs to cover the exfil; Salesforce Event Monitoring logs survived.",
      "Aug 20: Salesloft revoked all customer tokens, notifying customers Aug 23. Aug 28: Mandiant retained. Sep 6: containment confirmed.",
      "MITRE: T1199 Trusted Relationship, T1528 Steal Application Access Token, T1552, T1526, T1119, T1213, T1070.004 File Deletion, T1090.003 Multi-hop Proxy, T1567.002 Exfiltration Over Web Service."
    ],
    "whyItMatters": [
      "Drift's chatbot needed broad Salesforce OAuth to function: read contacts, write conversations, access cases. That grant was a standing, unmonitored credential inside 700+ orgs.",
      "When Drift's infrastructure was compromised, every customer's CRM was one API call away. The AI tool was the relay, not the target, so MFA, IP restrictions and Salesforce login controls never came into play.",
      "The nth-party blind spot: your AIBOM lists models and frameworks. It does not list the OAuth scopes your AI chatbot vendors hold to your CRM.",
      "Secrets pasted into CRM free-text fields (support cases, notes) are exfil targets by default. One victim found 104 exposed API tokens sitting inside Salesforce cases.",
      "Among the 700+ reconstructed exposures: Cloudflare, Google, Palo Alto Networks, Zscaler, CyberArk, Tenable, BeyondTrust, PagerDuty, SpyCloud, Elastic and JFrog."
    ],
    "whatToDo": [
      "Inventory the OAuth grants every conversational AI, copilot and agent vendor holds into your CRM, ticketing and email systems, and record the exact scopes. Revoke anything broader than the function requires.",
      "Rotate and re-scope tokens held by AI vendor integrations, and prefer short-lived credentials over standing grants.",
      "Hunt Salesforce Event Monitoring logs for the indicators below. Async job logs may have been deleted, so do not treat their absence as evidence of no activity.",
      "Sweep CRM free-text fields (support cases, notes, attachments) for embedded secrets: cloud keys, warehouse tokens, VPN credentials, plaintext passwords. Rotate everything found and assume exposure.",
      "Treat AI vendor integrations as supply chain links in vendor risk assessments, not as SaaS features."
    ],
    "indicators": [
      "UA: Salesforce-Multi-Org-Fetcher/1.0",
      "UA: Salesforce-CLI/1.0",
      "UA: Python-requests/2.32.4",
      "UA: Python/3.11 aiohttp/3.12.15",
      "IP: 208.68.36.90 (DigitalOcean)",
      "IP: 44.215.108.109 (AWS)",
      "Tor exit nodes: 185.220.101.x, 192.42.116.x",
      "Exfil window: Aug 9-17, 2025 (8 days, undetected)"
    ],
    "byAssociation": {
      "entries": [
        {
          "entity": "AWS keys",
          "identifier": "found inside Salesforce support cases"
        },
        {
          "entity": "Snowflake tokens",
          "identifier": "found inside Salesforce support cases"
        },
        {
          "entity": "VPN credentials",
          "identifier": "found inside Salesforce support cases"
        },
        {
          "entity": "Plaintext passwords",
          "identifier": "found inside Salesforce support cases"
        },
        {
          "entity": "API tokens (single victim)",
          "identifier": "104+ rotated"
        }
      ],
      "nuance": "The CRM records were the objective; the secrets customers had pasted into support-case text were the second, unplanned payload.",
      "caveat": "700+ is reconstructed exposure, not a confirmed breach count. More victims are expected as self-disclosures continue."
    },
    "sources": [
      {
        "label": "Anomali — chain analysis with MITRE mapping",
        "url": "https://www.anomali.com/blog/salesloft-drift-breach-recap"
      },
      {
        "label": "UpGuard — breach analysis, victim list, 700+ orgs",
        "url": "https://www.upguard.com/blog/salesloft-drift-breach"
      },
      {
        "label": "SOCRadar — disclosure analysis and exposed data inventory",
        "url": "https://socradar.io/blog/salesloft-drift-breach-everything-you-need-to-know"
      },
      {
        "label": "ProcessUnity — third-party risk lessons",
        "url": "https://www.processunity.com/resources/blogs/lessons-from-drift-salesloft-breach"
      },
      {
        "label": "FINRA — regulatory alert",
        "url": "https://www.finra.org/rules-guidance/guidance/salesloft-drift-AI-supply-chain-attack"
      },
      {
        "label": "CM Alliance — incident recap",
        "url": "TODO — deck URL truncated (cm-alliance.com/cybersecurity-blog/salesloft-drift-attack...)"
      },
      {
        "label": "Sangfor — Salesforce-specific analysis",
        "url": "TODO — add published URL"
      },
      {
        "label": "Safe Security — risk quantification",
        "url": "TODO — add published URL"
      },
      {
        "label": "McDermott Will & Emery — legal analysis",
        "url": "TODO — add published URL"
      },
      {
        "label": "Mandiant — retained by Salesloft, containment confirmed",
        "url": "TODO — add published URL"
      }
    ],
    "image": "/__l5e/assets-v1/c67c7d53-2138-4b71-b505-5aa8bdd5cd42/salesloft-drift-attack-chain.jpg",
    "imageAlt": "Optimus Labs attack-chain slide: Salesloft GitHub compromise into Drift AWS, stolen Salesforce OAuth tokens used as a trusted relay, with exfil window, indicators and timeline.",
    "pdfUrl": "TODO_PDF_URL",
    "socialDeckUrl": "TODO"
  }
}