Millions of company websites run a small chat widget in the bottom corner of the screen. It greets visitors, answers questions and routes leads. Most people never think twice about it.
That widget, and the invisible handshake it holds with a company’s customer database, turned out to be a master key nobody was watching.
What followed was one of the largest corporate data raids in recent memory, and it worked without cracking a single password or triggering a single login alert.
The companies involved are names everyone in tech recognizes
Between August 8 and 18, 2025, attackers exploiting compromised OAuth tokens associated with Salesloft’s Drift application, which integrates with Salesforce to help sales and marketing teams collaborate, gained access to numerous Salesforce customer instances, systematically exfiltrating large volumes of data.
Confirmed victims included BeyondTrust, Bugcrowd, Cato Networks, Cloudflare, CyberArk, Elastic, Google, JFrog, Nutanix, PagerDuty, Palo Alto Networks, Qualys, Rubrik, SpyCloud, Tanium, Tenable and Zscaler. That list reads like a roster of the companies that sell security to everyone else.
Chanel and Pandora also disclosed breaches of customer data linked to the ShinyHunters activity. None of them were hacked in the traditional sense. Nobody’s firewall was smashed through.
What the attackers were actually hunting inside all that data
The scale of what was taken is staggering. Using stolen tokens, the group accessed approximately 760 Salesforce customer organizations between August 8, 18, 2025, exfiltrating roughly 1.5 billion records across Account, Contact, Case, Opportunity, and User data tables.
But raw contact records were not the real prize.
The campaign’s focus was credential harvesting: stolen records were combed for AWS access keys, passwords, and cloud-service tokens such as Snowflake credentials that could enable follow-on compromises. Many companies kept these sensitive secrets in their CRM, which allowed the attackers to harvest high-value data at scale through legitimate-looking API calls.
Support cases, it turns out, are where engineers paste temporary credentials and API keys when asking for help, case data can include API keys, authentication tokens, and other secrets that enable lateral movement. Those became the next set of skeleton keys.
This kind of compounding threat, where one breach seeds the next, is exactly why researchers studying 153 GB of stolen credentials from a prior supply-chain attack warned that exposure rarely ends with the original incident.
How a dormant intrusion sat undetected for months before the raid began
The timeline reveals something unsettling about how gradually this unfolded.
The incident began with a compromise of Salesloft’s GitHub repository in March 2025, followed by a dormant period, and culminated in active exploitation from August 8 to 18, 2025.
For as long as five months, the attackers sat inside a code repository watching, waiting and gathering what they needed.
Indicators only surfaced from the internet when Tor exit nodes began performing GET requests at an abnormally high volume.
By then, ten days of exfiltration had already ended. The activity ran from August 8 to August 18 before Salesloft revoked all Drift tokens and disclosed the incident publicly in late August 2025.
The hidden mechanism: how a chatbot’s code repo became the door into 760 companies
Here is the part that most breach headlines skip entirely, and it changes how you think about every app connected to your business software.
ShinyHunters used the TruffleHog open-source security tool to scan source code repositories, discovering OAuth tokens for the Salesloft Drift AI chat integration, and used those tokens to access approximately 760 Salesforce customer organizations, exfiltrating roughly 1.5 billion records.
TruffleHog is a freely available scanner that searches code for accidentally committed secrets. The attackers ran it against Salesloft’s own GitHub repository and found live OAuth tokens sitting in the code.
Rather than phishing a user, the attackers compromised a vendor whose software already held OAuth access to its customers’ Salesforce orgs, stole the connection’s secrets, and used them to query and export data across many instances at once.
The threat actors abused trusted OAuth relationships for unauthorized access, using supply chain compromise through trusted workflows, with inherited user and application privileges allowing successful enumeration and querying of CRM records while evading conventional authentication detections.
Microsoft’s official security blog, published July 13, 2026, mapped three primary attack paths, vishing, supply chain compromise, and misconfigured guest access, and confirmed it worked with Salesforce to roll out new detection and governance tooling aimed at addressing the activity that authentication logs miss.
A subsequent campaign in November 2025 targeted Gainsight-published applications integrated with Salesforce, allowing attackers to leverage trusted external connections to maintain persistent API access in more than 200 Salesforce customer instances.
The vulnerability, in plain terms, is trust itself: the automated permission a company grants a vendor is inherited by anyone who steals that vendor’s keys. Security teams that track state-level attackers exploiting zero-days are used to looking at the platform. This attack never touched it.
What companies and users can actually do about a risk most dashboards cannot see
The good news is that the fix is practical, even if it requires discipline most organizations have not yet enforced.
Google’s Threat Intelligence Group reported that the actors’ primary objective was to steal sensitive information such as AWS access keys, passwords, and Snowflake-related access tokens.
The exposure was not universal: victims were limited to companies that had connected the Salesloft Drift application to their Salesforce environment, the breach was integration-specific. Threat actors breached Salesloft’s GitHub repository and discovered saved OAuth access tokens for the Drift chatbot, and armed with those tokens, they didn’t need to target companies individually; they held the keys to access Salesforce instances where the Drift app was authorized.
The August 2025 Salesloft Drift compromise is the clearest example: attackers stole OAuth and refresh tokens tied to the Drift AI chat integration, and the way in was the trust the organization had already extended through the OAuth connections that tie Salesforce to the apps and third-party vendors around it.
Security professionals now recommend auditing every connected app’s token lifespan, limiting which data objects each integration can touch, and scanning internal code repositories for committed secrets before an adversary’s automated tool does it first.
The chatbot in the corner of the screen did not fail. The assumption that a trusted connection stays trusted forever did.
