When Trusted Integrations Turn Hostile: The 2025 Salesforce OAuth Attacks

Modern Salesforce deployments don’t exist in isolation. They are hubs in a web of SaaS integrations, connected to marketing platforms, customer success tools, chat agents, email systems, and data warehouses through OAuth tokens and API credentials. Each of these connections represents a trust relationship: one application granting another the right to access data and perform actions on its behalf.

In 2025, attackers proved that these trust relationships are not just a theoretical risk. Two major supply chain campaigns (Salesloft Drift and Gainsight) demonstrated that compromising a single connected application can unlock access to hundreds of Salesforce environments simultaneously, bypassing multi-factor authentication (MFA), evading traditional detection, and enabling data theft at scale. This blog aims to break down how these attacks worked, what made them possible, and what security teams can do about it.

The Salesloft Drift attack was not the end of the story. Just a few months after the Salesloft Drift attack, in November 2025, a second campaign struck Gainsight, which is a widely used customer success platform that also integrates deeply with Salesforce through OAuth-authorized connected apps. The threat actor tracked as UNC6240 claimed responsibility, and there is a direct lineage between the two incidents: Gainsight itself had been one of the organizations affected by the earlier Salesloft Drift breach, and the attackers reportedly used secrets stolen in that first campaign to compromise Gainsight’s internal credentials and OAuth refresh tokens.

The pattern was nearly identical to the Drift campaign. On November 19th, Salesforce detected API calls originating from non-allowlisted IP addresses through Gainsight’s connected apps. The attackers had obtained OAuth refresh tokens associated with Gainsight’s Salesforce integrations and were using them to access customer Salesforce data the same way Gainsight itself would normally access that data. UNC6240 later claimed they accessed approximately 285 additional Salesforce instances through this second wave.

Salesforce responded by revoking all active access and refresh tokens associated with Gainsight-published applications and temporarily removing them from the AppExchange. Gainsight disabled its connectors to HubSpot, Zendesk, and other third-party integrations out of caution and engaged Mandiant for forensic investigation. The ripple effects were significant, disrupting customer success workflows, data synchronization, and support processes across Gainsight’s customer base.

What makes the Gainsight incident especially notable is the chain of lateral movement. The Drift breach led to credential harvesting, which led to the Gainsight compromise, which led to a second wave of Salesforce data theft. This is SaaS-to-SaaS lateral movement in practice: an attacker moving not between servers on a network, but between cloud platforms connected by trust relationships.

Why Detection Failed

Both campaigns were hard to catch, and for much the same reasons. In each case the attackers presented OAuth tokens that had been legitimately issued to a trusted connected app, Drift in one campaign, Gainsight in the other. Every API call looked like authorized activity from an integration the organization had already approved. There was no login to flag, no password, and no MFA challenge to trip an alarm. To the Salesforce environments on the receiving end, it looked like Drift and Gainsight doing exactly what they always do.

The rest of the tradecraft reinforced that cover. Traffic rode over standard HTTPS, no malware was deployed, and no endpoints were touched, so EDR (endpoint detection and response), SIEM (security information and event management) rules tuned for login anomalies, and network intrusion detection were all effectively blind. In the Drift campaign the attackers went further, using custom user-agent strings to mimic legitimate Drift traffic and deleting the Bulk API job records once their exports finished, erasing the most obvious forensic artifacts.

Where activity did surface, it tended to come from the platform layer rather than the victims' own tooling. In the Gainsight campaign it was Salesforce that flagged the API calls arriving from non-allowlisted IP addresses on November 19. Organizations without Salesforce Event Monitoring enabled or that weren't actively reviewing API access logs and SOQL query events had very limited visibility of their own. Defending against this pattern depends on watching integration and token activity, not user logins.

Both attacks followed an attack pattern that security teams need to understand. The mechanics are straightforward, which is why these attacks are so dangerous. There’s nothing special about it; just the systematic abuse of how SaaS integrations are designed to work.

• Step 1: Compromise the integration, not the target. The attackers never targeted Salesforce directly. They compromised third party applications that held OAuth tokens which granted access to customer Salesforce environments.

• Step 2: Use the token, not the login. OAuth tokens bypass the normal authentication flow entirely. There is no username, no password, and no MFA challenge. The token is passed to the Salesforce API and the platform treats the request as authorized. This is why traditional identity security controls are ineffective against this attack vector.

• Step 3: Enumerate and exfiltrate. Once authenticated into the platform, the attackers used SOQL queries to enumerate available objects and used the Bulk API for high-volume data extraction.

• Step 4: Harvest credentials for the next hop. Attackers scanned the exfiltrated data for embedded secrets, which could then be used for lateral movement.

• Step 5: Clean up. In some environments, the attackers deleted the Bulk API job records and other artifacts to cover their tracks. Organizations without robust Salesforce monitoring had limited ability to reconstruct what had happened after the incident.

The Salesloft Drift and Gainsight breaches represent a shift in how threat actors attack enterprise environments. Instead of targeting organizations directly, they target the connections between them. A single compromised integration unlocked access to hundreds of Salesforce environments. Stolen CRM data yielded credentials that enabled further lateral movement to entirely separate platforms. No malware was deployed. No vulnerabilities were exploited. The attackers simply used the trust relationships that organizations had already established.

For security teams, the lesson is clear: your Salesforce security posture does not end at the boundary of your Salesforce organization. Every connected app, every OAuth token, and every integration user extends that boundary into external systems you may not control. Understanding and mapping those connections is no longer optional, it is a requirement for defending against the attacks that are already happening.

Phantom Labs™ researchers "think like attackers" to expose privilege escalation paths and identity attack vectors, helping defenders proactively uncover misconfigurations and detect threats in complex hybrid and cloud environments. Using advanced graph modeling, Phantom Labs researchers map attack paths to privileged access across cloud and on-premises infrastructure.