Cybersafetyconnections October 6,2025 vol#238
- According to cloud.google.com there was a cyberattack that involved Google Workspace and Salesforce via Drift integration.
- Users of Google Workspace and Salesforce accounts that were configured with drift were affected.
- The cyberattack resulted from exploiting SaaS connector of API.
- No cybercriminal group claimed responsibility for the attack.
- Here is how Google Workspace and Sales Force mitigated loss from the cyberattack.
What happened?
According to securafy in August 2025, there was a Zero-day exploit that targeted Drift’s OAuth tokens. Hackers took advantage of Drift’s OAuth tokens via Drift Chatbot integration’s vulnerability to gain access and maintain control in Workspace and Salesforce environment for a long period of time.
These hackers stole large volumes of data that included:
- AWS access keys (AKIA)
- Snowflake tokens
- Internal passwords and secrets
The attackers deleted the query logs to cover their tracks.
Who was impacted?
According to google, only Workspace and Salesforce accounts set up with Drift suffered the impact of this hack and the hack did not infect the whole of Google ecosystem.
Why did it happen?
The OAuth tokens used to generate Time-Based One-Time Password (TOTP) for multi-factor authentication (MFA) to verify user’s identity when logging into a system was the point of weakness used by hackers to carry out the zero-day exploit.
The weakness in the Application Programming Interface (API) that bridges different software applications to communicate and exchange data with each other is what hackers exploited to carry out the attack.
The SaaS (Software as a Service) connector widened the attack surface for the hackers to attack before the weakness was addressed.
Which cybercriminals were responsible for the cyberattack?
We have mention of hackers with no mention of a particular name and hackers deleting query logs to avoid been found out.
How did Google Workspace and Salesforce mitigate loss from the attack?
OWASP Threat and Safeguard Matrix
Here is the scope on how Workspace and Sales Force mitigate loss from the cyberattack.
From Copilot, we have;
Google Workspace and Salesforce mitigated losses from the Drift integration cyberattack through a series of swift and strategic actions that limited further exposure and restored trust. Here’s how they responded effectively:
🛡️ Mitigation Measures Taken
1. Token Revocation and App Removal
- Salesforce immediately revoked all OAuth tokens associated with Drift and removed the Drift app from AppExchange, cutting off the attacker’s access vector.
- This action prevented further unauthorized API calls and halted data exfiltration.
2. Targeted Containment
- Google confirmed that only Workspace accounts configured with Drift were affected—not the broader Google ecosystem.
- This containment helped reassure stakeholders and isolate the breach scope.
3. Forensic Investigation
- Salesloft, another impacted integration partner, engaged Mandiant to conduct a forensic investigation.
- This helped identify compromised credentials, assess data loss, and guide remediation.
4. Communication and Transparency
- Public disclosures clarified the nature of the breach and emphasized that core platforms (Google Workspace and Salesforce) were not directly compromised.
- This transparency helped maintain user trust and regulatory compliance.
5. Security Hardening
- Both platforms likely implemented stricter OAuth token policies, including:
- Shorter token lifespans
- Enhanced anomaly detection
- Mandatory token rotation schedules
🔧 Strategic Lessons for Future Resilience
This breach underscores the importance of:
- SaaS integration audits: Regularly review third-party connectors for scope creep and token hygiene.
- Playbook updates: Include scenarios for OAuth-based breaches and third-party API abuse.
- Stakeholder education: Ensure teams understand the hidden risks of convenience-driven integrations.
Subscribe to get the latest blog post.
