Cyberdudebivash

Salesloft / Drift Breach – A CyberDudeBivash Incident Report By CyberDudeBivash – Cybersecurity, AI & Threat Intelligence Network

ai, cyber-security, cybersecurity, security, technology

cyberdudebivash.com | cyberbivash.blogspot.com

Executive Summary

In a recent supply chain attack, a data breach originating from a compromised Salesloft GitHub account led to the exposure of sensitive OAuth tokens. These tokens, belonging to Drift customers’ integrations, were abused in attacks against 22 downstream companies.

Threat group UNC6395 has been attributed to this campaign, demonstrating once again how OAuth token theft is becoming a weapon of choice in supply chain intrusions.

Timeline of the Attack

Initial Compromise: GitHub account linked to Salesloft breached by attackers.
Lateral Impact: OAuth tokens from Drift’s customer integrations stolen.
Supply Chain Ripple Effect: 22 companies affected, with potential for wider impact across integrations.
Attribution: Campaign linked to UNC6395, an actor known for exploiting trust-based integrations.

Technical Breakdown

Attack Vector

GitHub repo compromise enabled injection of malicious code.
Harvested OAuth tokens allowed unauthorized API access.
Tokens gave attackers ability to impersonate trusted services.

Impacted Assets

Salesloft CRM data
Drift integrations across marketing and customer engagement platforms
22 companies confirmed downstream victims

Risks

Data exfiltration of customer records, marketing intel, and CRM notes.
Business email compromise (BEC) through hijacked integrations.
Supply chain risk amplification – each integrated vendor multiplies the impact surface.

Countermeasures by CyberDudeBivash

OAuth Token Hygiene
- Rotate OAuth tokens regularly.
- Restrict token scopes to least privilege.
- Monitor for suspicious token usage.
Code Repository Security
- Enforce MFA and hardware keys for GitHub accounts.
- Enable branch protection + signed commits.
- Scan repos for secrets exposure before deployment.
Supply Chain Risk Controls
- Maintain a third-party risk registry for all integrations.
- Apply Zero Trust Access between SaaS tools.
- Audit integrations for over-permissioned APIs.
SOC Response Playbook
- Hunt for anomalous OAuth activity.
- Correlate CRM + marketing app logs with identity provider events.
- Block known malicious IPs tied to UNC6395.

Why This Matters

Supply chain attacks targeting trusted SaaS integrations are increasingly common. The Salesloft / Drift breach proves that a single compromised developer account can ripple across dozens of companies, making OAuth tokens the crown jewels for attackers.

Organizations must shift from reactive detection to proactive prevention—hardening OAuth usage, enforcing repository security, and applying Zero Trust to integrations.