One stolen OAuth token, 700 companies. The Salesloft–Drift breach was a reachability problem.

In August 2025 a threat group didn’t breach 700 companies. It breached one integration, and 700 companies were reachable through it. The Salesloft–Drift incident is the clearest example we have of what a non-human identity actually is: a trust relationship you forgot you granted.

The actor, tracked as UNC6395 (adjacent to ShinyHunters), used stolen Drift OAuth tokens to query the Salesforce orgs of 700+ organizations, Cloudflare, Google, Palo Alto Networks, Zscaler and Proofpoint among the named. Then it did the thing that turns a breach into a supply chain: it searched the exported data for more credentials.

What happened

Drift is a marketing-chat tool that integrates into Salesforce via OAuth. When you connect it, you hand Drift a token that can read and query your CRM on your behalf, a non-human identity acting for your org, indefinitely, until someone revokes it. Per Google’s threat intelligence team, the actor obtained those tokens and used them to run bulk SOQL exports across every connected tenant, then grepped the results for high-value secrets.

There was no exotic exploit. The token did exactly what it was authorized to do. The failure was that nobody had asked the second question: if this one token is compromised, what does it reach?

Trust you never granted

OAuth tokens in SaaS are transitive trust. You trust Drift. Drift is trusted by Salesforce because you said so. So an attacker who compromises Drift inherits your Salesforce, without ever touching your login, your MFA, or your network. Multiply that across every “Connect with…” button your teams have clicked, and you get OAuth sprawl: a web of standing grants no single person can see end to end.

A password is something you can rotate. A forgotten OAuth grant is a door you don’t remember installing.

This is the same failure mode as the Railway agent incident, an over-privileged non-human identity reaching a target no one reviewed, just expressed through SaaS instead of infrastructure.

Anatomy of the path

drift-oauth-token     # stolen; scoped to read/query Salesforce
  → salesforce-org     # × 700+ connected tenants
  → SOQL bulk export   # pull everything the token can see
  → embedded-secrets     # AWS keys, Snowflake tokens in the data
  → downstream-systems   # the next environment entirely

The cascade: Drift → Gainsight → Klue

The reason this belongs in a strategy meeting and not just an incident channel is that it didn’t stop. Secrets harvested in the Salesloft wave were reused. In November 2025, Gainsight OAuth tokens were obtained for up to ~285 Salesforce instances. In June 2026, the Klue “Icarus” campaign queried ~195 environments (Huntress, HackerOne, Tanium, LastPass, Snyk, Gong among them), starting from a forgotten legacy service account.

What good looks like

You can’t remove OAuth integrations, they run your business. You can make sure you know what each one reaches, and revoke the ones that reach too far:

1. Discover every OAuth grant and service account. Including the ones an offboarded contractor connected two years ago.
2. Trace where each token reaches, across SaaS, cloud and warehouse, not just its label.
3. Flag transitive trust to sensitive data. A marketing tool that can export your entire CRM is a path, not a feature.
4. Cut and rotate the edge that matters, and offboard NHIs the moment they go idle.

The 700 companies weren’t careless. They were blind to reachability, which is a different, fixable problem. Elmoz maps the trust you never granted.