"The ShinyHunters extortion group claims to have stolen over 1.5 billion Salesforce records from 760 companies using compromised Salesloft Drift OAuth tokens.
[...]
In March, one of the threat actors breached Salesloft's GitHub repository, which contained the private source code for the company.
ShinyHunters told BleepingComputer that the threat actors used the TruffleHog security tool to scan the source code for secrets, which resulted in the finding of OAuth tokens for the Salesloft Drift and the Drift Email platforms."
Read more of Lawrence Abrams' great reporting on Bleeping Computer:
https://www.bleepingcomputer.com/news/security/shinyhunters-claims-15-billion-salesforce-records-stolen-in-drift-hacks/
#Salesforce #Salesloft #Oauth #Drift #databreach #ransom #ShinyyHunters #ScatteredSpider #LAPSUS$ #UNC6040 #UNC6395
Dissent Doe :cupofcoffee:
npub17l…k4kr3
2025-09-17 21:32:30 UTC
Author Public Key
npub17l5x90j8qck2eeyjdqhshha8lp6vyq6vh3w7v5qp2gcfzhsma0lshk4kr3Seen on
wss://relay.momostr.pinkPublished at
2025-09-17 21:32:30 UTCEvent JSON
{
"id": "b0df1c261f880b91eab22e1c6d9dc6c8e8442865e4568e10df056025acbb7e0f",
"pubkey": "f7e862be47062cace492682f0bdfa7f874c2034cbc5de650015230915e1bebff",
"created_at": 1758144750,
"kind": 1,
"tags": [
[
"t",
"oauth"
],
[
"t",
"drift"
],
[
"t",
"databreach"
],
[
"t",
"scatteredspider"
],
[
"t",
"salesforce"
],
[
"t",
"salesloft"
],
[
"t",
"shinyyhunters"
],
[
"t",
"ransom"
],
[
"t",
"unc6040"
],
[
"t",
"lapsus"
],
[
"t",
"unc6395"
],
[
"proxy",
"https://infosec.exchange/@PogoWasRight/115221774356295875",
"web"
],
[
"proxy",
"https://infosec.exchange/users/PogoWasRight/statuses/115221774356295875",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/PogoWasRight/statuses/115221774356295875",
"pink.momostr"
],
[
"-"
]
],
"content": "\"The ShinyHunters extortion group claims to have stolen over 1.5 billion Salesforce records from 760 companies using compromised Salesloft Drift OAuth tokens.\n\n[...]\n\nIn March, one of the threat actors breached Salesloft's GitHub repository, which contained the private source code for the company.\n\nShinyHunters told BleepingComputer that the threat actors used the TruffleHog security tool to scan the source code for secrets, which resulted in the finding of OAuth tokens for the Salesloft Drift and the Drift Email platforms.\"\n\nRead more of Lawrence Abrams' great reporting on Bleeping Computer:\nhttps://www.bleepingcomputer.com/news/security/shinyhunters-claims-15-billion-salesforce-records-stolen-in-drift-hacks/\n\n#Salesforce #Salesloft #Oauth #Drift #databreach #ransom #ShinyyHunters #ScatteredSpider #LAPSUS$ #UNC6040 #UNC6395",
"sig": "30e89b087f6d2bd09fec6a18975bd63acb788aa10fe701623cbc12fef0477af6092e3d7db37c7dedbc4228cc40d13fd73e805ca35c64586a50c64c2339ccb905"
}