# Stolen OAuth Tokens Let Attackers Loot 700+ CRMs via AI Chatbot
> Attackers compromised Salesloft's GitHub, moved into Drift's AWS, and stole the OAuth tokens Drift's AI chatbot held for customer Salesforce instances. The tokens were already trusted. No credentials to crack.
- **Publisher:** Optimus Labs · Civilizations
- **Published:** 2025-09-06
- **Severity:** CRITICAL · SUPPLY CHAIN
- **Types:** Supply chain, Vendor breach, Shadow AI
- **Categories:** SC — Supply Chain nth Party Risk; AI — AI Asset Supply Chain Security; AP — Agent Permissions; OL — Outside the Agentic Loop
- **Vendors / products affected:** Salesloft, Drift, Salesforce, GitHub, AWS
- **Blast radius:** 700+ organizations exposed (reconstructed, not a confirmed breach count). Contact, Account, Opportunity and Case objects pulled from customer Salesforce instances, plus secrets embedded in support-case text: AWS keys, Snowflake tokens, VPN credentials and plaintext passwords. One victim rotated 104+ API tokens. Exfil window Aug 9-17, 2025, undetected.
- **Canonical URL:** https://www.optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain
## Summary

Drift is an AI-powered conversational sales chatbot (acquired by Salesloft in 2024) deployed across thousands of enterprise websites with read/write OAuth grants into customer CRMs. Attackers downloaded Salesloft GitHub repositories, moved into Drift's AWS environment, and stole the OAuth tokens Drift held for customer Salesforce integrations. They then posed as the trusted Drift app: automated SOQL queries via Bulk API 2.0 pulled contacts, accounts, opportunities and support cases. Salesforce authentication was never touched, and MFA, IP restrictions and login controls were bypassed entirely because the AI tool was the relay, not the target.

## What happened

- Attacker was active in Salesloft infrastructure Mar-Jun 2025, downloading GitHub repositories and pivoting into Drift's AWS environment.
- Aug 9, 2025: recon using Trufflehog against the stolen Salesforce tokens.
- Aug 12-14: schema enumeration via Salesforce APIs. Aug 17: bulk exfiltration via Bulk API 2.0 and automated SOQL queries driven by Python scripts, roughly 3 minutes per large dataset.
- The attacker deleted async job logs to cover the exfil; Salesforce Event Monitoring logs survived.
- Aug 20: Salesloft revoked all customer tokens, notifying customers Aug 23. Aug 28: Mandiant retained. Sep 6: containment confirmed.
- MITRE: T1199 Trusted Relationship, T1528 Steal Application Access Token, T1552, T1526, T1119, T1213, T1070.004 File Deletion, T1090.003 Multi-hop Proxy, T1567.002 Exfiltration Over Web Service.

## Why it matters

- Drift's chatbot needed broad Salesforce OAuth to function: read contacts, write conversations, access cases. That grant was a standing, unmonitored credential inside 700+ orgs.
- When Drift's infrastructure was compromised, every customer's CRM was one API call away. The AI tool was the relay, not the target, so MFA, IP restrictions and Salesforce login controls never came into play.
- The nth-party blind spot: your AIBOM lists models and frameworks. It does not list the OAuth scopes your AI chatbot vendors hold to your CRM.
- Secrets pasted into CRM free-text fields (support cases, notes) are exfil targets by default. One victim found 104 exposed API tokens sitting inside Salesforce cases.
- Among the 700+ reconstructed exposures: Cloudflare, Google, Palo Alto Networks, Zscaler, CyberArk, Tenable, BeyondTrust, PagerDuty, SpyCloud, Elastic and JFrog.

## What to do

- Inventory the OAuth grants every conversational AI, copilot and agent vendor holds into your CRM, ticketing and email systems, and record the exact scopes. Revoke anything broader than the function requires.
- Rotate and re-scope tokens held by AI vendor integrations, and prefer short-lived credentials over standing grants.
- Hunt Salesforce Event Monitoring logs for the indicators below. Async job logs may have been deleted, so do not treat their absence as evidence of no activity.
- Sweep CRM free-text fields (support cases, notes, attachments) for embedded secrets: cloud keys, warehouse tokens, VPN credentials, plaintext passwords. Rotate everything found and assume exposure.
- Treat AI vendor integrations as supply chain links in vendor risk assessments, not as SaaS features.

## Leaked by association

- AWS keys: found inside Salesforce support cases
- Snowflake tokens: found inside Salesforce support cases
- VPN credentials: found inside Salesforce support cases
- Plaintext passwords: found inside Salesforce support cases
- API tokens (single victim): 104+ rotated

The CRM records were the objective; the secrets customers had pasted into support-case text were the second, unplanned payload.

700+ is reconstructed exposure, not a confirmed breach count. More victims are expected as self-disclosures continue.

## Indicators of compromise

- UA: Salesforce-Multi-Org-Fetcher/1.0
- UA: Salesforce-CLI/1.0
- UA: Python-requests/2.32.4
- UA: Python/3.11 aiohttp/3.12.15
- IP: 208.68.36.90 (DigitalOcean)
- IP: 44.215.108.109 (AWS)
- Tor exit nodes: 185.220.101.x, 192.42.116.x
- Exfil window: Aug 9-17, 2025 (8 days, undetected)

## Sources

- [Anomali — chain analysis with MITRE mapping](https://www.anomali.com/blog/salesloft-drift-breach-recap)
- [UpGuard — breach analysis, victim list, 700+ orgs](https://www.upguard.com/blog/salesloft-drift-breach)
- [SOCRadar — disclosure analysis and exposed data inventory](https://socradar.io/blog/salesloft-drift-breach-everything-you-need-to-know)
- [ProcessUnity — third-party risk lessons](https://www.processunity.com/resources/blogs/lessons-from-drift-salesloft-breach)
- [FINRA — regulatory alert](https://www.finra.org/rules-guidance/guidance/salesloft-drift-AI-supply-chain-attack)
- CM Alliance — incident recap (URL pending)
- Sangfor — Salesforce-specific analysis (URL pending)
- Safe Security — risk quantification (URL pending)
- McDermott Will & Emery — legal analysis (URL pending)
- Mandiant — retained by Salesloft, containment confirmed (URL pending)

---

Published by Optimus Labs · Civilizations, the threat research team at Optimus Labs. Optimus Labs secures the enterprise agentic AI attack surface: discovery and governance of every AI agent, MCP server, and skill, posture management against the OWASP Top 10 for Agentic Applications, and runtime behavior anomaly detection. More briefings: https://www.optimuslabs.io/research/briefings