Salesloft, Drift Breach Tied to GitHub, OAuth Theft

Hackers breached the systems of Salesloft and Drift after compromising GitHub repositories and stealing OAuth tokens, according to a report detailing the Salesloft Drift breach. The attackers gained unauthorized access by targeting developer credentials, enabling them to exploit the companies’ integration tools.

The incident involved the abuse of OAuth tokens issued to third-party applications connected to GitHub. These tokens allowed the attackers to move laterally within both organizations’ systems. Investigators found that the threat actors used the stolen credentials to access sensitive information and potentially disrupt business operations. In the broader context of the Salesloft Drift breach, the event underscores the growing risks tied to software supply chain vulnerabilities and token-based authentication.

Both companies are reportedly working to contain the breach and assess the full scope of the compromise. Security teams have urged customers to monitor activity and rotate credentials where necessary.

Read the complete report for more details:

Salesloft Drift Breach Traced to GitHub Compromise and Stolen OAuth Tokens