Several large tech companies, including Cloudflare, Zscaler, Palo Alto Networks, and Google Workspace, as well as other companies like PagerDuty and Proofpoint, have reported data breaches linked to a sophisticated supply chain attack involving the Salesloft Drift platform. This campaign, tracked by Mandiant as UNC6395, targeted Salesforce instances between August 8 and August 18, aiming to steal sensitive credentials like AWS access keys and Snowflake tokens. The breaches were traced to Drift, an AI chatbot company acquired by Salesloft, which typically integrates with systems to track customer engagements. Cloudflare discovered the breach on August 23 and took measures to rotate one hundred and four (104) compromised API tokens, although no suspicious activity was detected. The company emphasized that customer contact information and support case data were affected, urging customers to rotate any shared credentials. Palo Alto Networks similarly reported the theft of business contact information and internal sales account data but noted that its products and systems remained unaffected. The attackers used voice phishing (vishing) to trick employees into linking malicious OAuth apps with Salesforce instances, a tactic employed by the ShinyHunters extortion group. While some researchers suggest a link between ShinyHunters and the Salesloft breaches, researchers have not found conclusive evidence. Experts have advised all Salesloft Drift customers to treat authentication tokens as potentially compromised, revoking tokens and disabling integration functionalities to prevent further exploitation. Salesforce has temporarily disabled integrations with Salesloft as a precaution and announced the temporary suspension of its Drift platform following the widespread supply chain attack. CTIX analysts recommend affected companies to rotate credentials and conduct forensic investigations to prevent further exploitation.