CyberScoop reports that organizations using Google Workspace and other tools integrating the third-party artificial intelligence chat agent Salesloft Drift have also been impacted by the sweeping attacks involving stolen Drift OAuth tokens, which were initially noted to compromise Salesforce systems.
Threat operation UNC6395 had leveraged pilfered OAuth tokens from Salesloft Drift to compromise very few Google Workspace accounts' emails, said the Google Threat Intelligence Group in an updated report. Other organizations that previously used Drift may have also been affected.
Additional details regarding the intrusion, including its primary vector, remain uncertain amid an ongoing probe alongside Google Cloud's Mandiant incident response division and cyberinsurance firm Coalition.
"We are working with Salesloft Drift to investigate the root cause of what occurred and then it'll be up to them to publish that. There will be a lot more tomorrow, and the next day, and the next day," said Mandiant Consulting Chief Technology Officer Charles Carmakal.
Threat operation UNC6395 had leveraged pilfered OAuth tokens from Salesloft Drift to compromise very few Google Workspace accounts' emails, said the Google Threat Intelligence Group in an updated report. Other organizations that previously used Drift may have also been affected.
Additional details regarding the intrusion, including its primary vector, remain uncertain amid an ongoing probe alongside Google Cloud's Mandiant incident response division and cyberinsurance firm Coalition.
"We are working with Salesloft Drift to investigate the root cause of what occurred and then it'll be up to them to publish that. There will be a lot more tomorrow, and the next day, and the next day," said Mandiant Consulting Chief Technology Officer Charles Carmakal.
