SAN FRANCISCO — A highly sophisticated supply chain attack targeting the B2B software ecosystem has exposed a critical vulnerability in how enterprise applications communicate. The threat actor, tracked by Mandiant as UNC6395 and commonly referred to as the “Icarus” campaign, successfully infiltrated over 700 organizations by exploiting compromised OAuth tokens issued to the Salesloft Drift integration for Salesforce.
The breach, which occurred between June 8 and mid-August, allowed attackers to bypass multi-factor authentication (MFA) controls entirely, extracting highly sensitive corporate data—including plaintext AWS keys, Snowflake database tokens, and VPN credentials.
The incident has sent shockwaves through the enterprise software sector, exposing the fragile trust relationships inherent in third-party SaaS integrations and forcing Chief Information Security Officers (CISOs) to urgently audit their external API permissions.
The Mechanics of an OAuth Supply Chain Attack
The Icarus campaign did not rely on traditional malware or phishing, nor did it exploit a zero-day vulnerability in Salesforce’s core architecture. Instead, the attackers abused the Open Authorization (OAuth) protocol—the industry standard that allows third-party applications to access enterprise data without exposing raw passwords.
According to incident analysis published by Google Cloud Threat Intelligence and Mandiant, the attackers obtained valid OAuth tokens previously issued to the Salesloft Drift application. Because Salesforce already inherently trusted these tokens, the attackers were able to authenticate directly against Salesforce APIs, effortlessly bypassing all MFA challenges.
“This incident highlights the often-overlooked risks associated with third-party SaaS integrations,” threat researchers noted in their technical breakdown. “Once a token is issued, it acts as a persistent skeleton key until it is actively revoked.”
Data Exfiltration: Targeting the Support Desk
After achieving initial access, UNC6395 initiated a sophisticated reconnaissance phase. Using Salesforce Object Query Language (SOQL), the attackers systematically enumerated the database schemas of the compromised organizations. They utilized custom Python scripts and spoofed User-Agent strings (such as Salesforce-CLI/1.0) to blend in with legitimate administrative traffic.
The primary objective was credential harvesting. The attackers heavily targeted Salesforce “Case” objects—the standard records used by corporate support desks. Historically, IT administrators and clients frequently paste plaintext passwords, VPN credentials, and API keys directly into support tickets when troubleshooting issues.
By executing automated bulk exports of these support cases, the attackers successfully siphoned a massive trove of secondary credentials. Cybersecurity firm Arctic Wolf confirmed the severity of the exfiltration, noting that the stolen data provides threat actors with the direct access keys required to breach deeper corporate infrastructure, including cloud hosting environments and data warehouses like Snowflake.
Defense Evasion and Incident Response
To mask their tracks, the attackers systematically deleted Salesforce asynchronous job logs and routed their API calls through anonymizing Tor exit nodes and rented cloud infrastructure on AWS and DigitalOcean.
The malicious activity was eventually detected by Salesloft security teams. In a coordinated emergency response with Salesforce and Google Workspace administrators, all active Drift OAuth tokens were revoked globally. The Drift integration was forcibly disabled and removed from the Salesforce AppExchange to halt the exfiltration pipeline.
While rapid containment prevented further data loss, the downstream effects of the stolen credentials are still unfolding. Organizations that process billions of dollars through B2B SaaS payment gateways are now operating under the assumption that their internal support logs have been compromised.
The Imperative for API Auditing and Least-Privilege Access
The Salesloft Drift breach serves as a stark warning regarding the proliferation of the API economy. As enterprise tech stacks become increasingly decentralized, the connective tissue between applications—the OAuth tokens and API keys—has become the primary target for advanced persistent threats (APTs).
Security experts are urgently advising enterprise IT departments to implement strict “least-privilege” and “zero-trust” architectures for all third-party integrations. This requires deploying advanced enterprise IT management and auditing platforms capable of continuously monitoring API call volume anomalies and automatically expiring dormant OAuth tokens.
Furthermore, this incident underscores a critical failure in basic operational security: the transmission of plaintext secrets via customer support channels. Until organizations mandate the use of encrypted, ephemeral credential-sharing tools across their support teams, CRM databases will remain a highly lucrative target for ransomware syndicates and data brokers.
