UNC6395 Salesloft Drift token-theft campaign
Campaign
Summary
Hide ▲
Show ▼
The UNC6395 campaign against Salesloft Drift has widened into a multi-victim disclosure wave, increasing uncertainty about how many customer environments were exposed. Stolen OAuth and refresh tokens from the Salesforce integration were used to move laterally into customer systems and steal data. Reported impacts range from business contact details to support content that may include tokens or passwords. The operation’s true blast radius remains unresolved as additional victims continue to assess exposure.
Related Happenings
BlackFile vishing extortion campaign targeting retail and hospitality organizations
Campaign
H score37
First: 24.04.2026 21:26
Last: 24.04.2026 21:26
Sources 1
About this happening:
The BlackFile campaign is driving vishing-based data theft and extortion against retail and hospitality organizations, putting employee credentials and enterprise data...
BlackFile vishing extortion campaign targeting retail and hospitality organizations
CampaignAbout this happening: The BlackFile campaign is driving vishing-based data theft and extortion against retail and hospitality organizations, putting employee credentials and enterprise data...
UNC6783 BPO compromise campaign targeting downstream companies
Campaign
H score65
First: 09.04.2026 00:46
Last: 09.04.2026 00:46
Sources 1
About this happening:
UNC6783 is an active BPO compromise campaign targeting business process outsourcers and large enterprises to reach downstream environments for extortion. The opera...
UNC6783 BPO compromise campaign targeting downstream companies
CampaignAbout this happening: UNC6783 is an active BPO compromise campaign targeting business process outsourcers and large enterprises to reach downstream environments for extortion. The opera...
OAuth device-code phishing campaign targeting SaaS accounts
Campaign
H score43
First: 04.04.2026 17:17
Last: 04.04.2026 17:17
Sources 1
About this happening:
A device code phishing campaign now includes EvilTokens, a phishing-as-a-service kit sold on Telegram that uses the OAuth 2.0 device authorization flow to hija...
OAuth device-code phishing campaign targeting SaaS accounts
CampaignAbout this happening: A device code phishing campaign now includes EvilTokens, a phishing-as-a-service kit sold on Telegram that uses the OAuth 2.0 device authorization flow to hija...
ShinyHunters widespread Okta SSO data theft campaign
Campaign
H score43
First: 03.04.2026 20:41
Last: 03.04.2026 20:41
Sources 1
About this happening:
ShinyHunters is tied to a widespread campaign that compromised Okta SSO accounts to steal data from third-party cloud storage and SaaS platforms, widening the...
ShinyHunters widespread Okta SSO data theft campaign
CampaignAbout this happening: ShinyHunters is tied to a widespread campaign that compromised Okta SSO accounts to steal data from third-party cloud storage and SaaS platforms, widening the...
DPRK-linked cryptoasset theft campaign continuing into 2026
Campaign
H score35
First: 03.04.2026 11:35
Last: 03.04.2026 11:35
Sources 1
About this happening:
The DPRK-linked cryptoasset theft campaign is continuing into 2026, keeping crypto and Web3 targets at risk of repeated theft and laundering activity. The operation us...
DPRK-linked cryptoasset theft campaign continuing into 2026
CampaignAbout this happening: The DPRK-linked cryptoasset theft campaign is continuing into 2026, keeping crypto and Web3 targets at risk of repeated theft and laundering activity. The operation us...
Timeline
-
04.09.2025 19:52 2 articles · 10mo ago
UNC6395 Salesloft Drift token theft campaign widens across customer environments
Campaign Scope UpdateUNC6395 stole OAuth and refresh tokens from Salesloft's Salesforce integration during Aug. 8-18, used those tokens to move laterally into certain Salesloft customer environments, and triggered downstream breach disclosures from organizations including Zscaler, Palo Alto Networks, Proofpoint, Cloudflare, and Tenable. Salesloft revoked active access and refresh tokens in Drift, Salesforce disabled all Salesloft integrations to Salesforce until further notice, and Google warned Drift customers to treat authentication tokens stored in or connected to Drift as potentially compromised. The campaign's full blast radius remains unclear.
Show sources
- Blast Radius of Salesloft Drift Attacks Remains Uncertain — www.darkreading.com — 04.09.2025 19:52
- Blast Radius of Salesloft Drift Attacks Remains Uncertain — www.darkreading.com — 04.09.2025 19:52