Tuesday , September 2 2025
Salesforce

Palo Alto Networks data breach exposes customer info via Salesforce Instances

Palo Alto Networks suffered a data breach that exposed customer data and support cases after attackers abused compromised OAuth tokens from the Salesloft Drift breach to access its Salesforce instance.

The company states that it was one of hundreds of companies affected by a supply-chain attack disclosed last week, in which threat actors abused the stolen authentication tokens to exfiltrate data.

Palo Alto Networks data breach exposes customer info via Salesforce Instances

Palo Alto Networks suffered a data breach that exposed customer data and support cases after attackers abused compromised OAuth tokens...
Read More
Palo Alto Networks data breach exposes customer info via Salesforce Instances

Entirely False: Google Confirms Gmail Data Breach Warning Is Fake

A viral story claims that Google has warned all 2.5 billion Gmail users about account risks due to a recent...
Read More
Entirely False: Google Confirms Gmail Data Breach Warning Is Fake

Hackers’ Reportedly Ultimatum Google To Fire Two Employees: Threaten Data Leak

Hackers on Telegram threatened to leak Google databases unless the company fires two employees. A hacking group urged the tech...
Read More
Hackers’ Reportedly Ultimatum Google To Fire Two Employees: Threaten Data Leak

Hacker to Register Domains to Launch Cyberattack Coming FIFA World cup 2026

Domains aimed at capitalizing on the FIFA Club World Cup 2025 in the U.S. have been discovered, signaling preparations for...
Read More
Hacker to Register Domains to Launch Cyberattack Coming FIFA World cup 2026

Next.js and HashiCorp Vuln Found: Patch Now!

A critical security flaw in the Next.js framework, marked as CVE-2025-29927, lets attackers bypass authorization, threatening web applications. This vulnerability...
Read More
Next.js and HashiCorp Vuln Found: Patch Now!

ChatGPT Leaks: 1,000 Public AI Conversations Analyzed: What research find

Sharing personal secrets with an AI chatbot can be risky. In early August, many were stunned to find that thousands...
Read More
ChatGPT Leaks: 1,000 Public AI Conversations Analyzed: What research find

“SikkahBot” Malware targets “bKash” “Nagad” “MYGP” “DBBL” with banking users in Bangladesh

A new Android malware called SikkahBot is targeting students in Bangladesh by pretending to be official apps from the Bangladesh...
Read More
“SikkahBot” Malware targets “bKash” “Nagad” “MYGP” “DBBL” with banking users in Bangladesh

F5 Executive Forum in Dhaka Explores App Delivery, Security, and AI Challenges

As organizations embrace digital transformation, the complexity of managing applications across Hybrid, Multicloud, and AI-driven environments continues to grow. Than...
Read More
F5 Executive Forum in Dhaka Explores App Delivery, Security, and AI Challenges

PromptLock: The First AI-Driven Ransomware Appears

AI-driven malware has emerged sooner than anticipated, with the first identified ransomware using AI for local tasks now found. ESET...
Read More
PromptLock: The First AI-Driven Ransomware Appears

CVE-2025-55177
WhatsApp patches zero day vuln exploited in the wild

Meta's WhatsApp Security Team has fixed a zero-day vulnerability (CVE-2025-55177) in WhatsApp for iOS (before v2.25.21.73), WhatsApp Business for iOS...
Read More
CVE-2025-55177  WhatsApp patches zero day vuln exploited in the wild

BleepingComputer learned of the breach this weekend from Palo Alto Networks’ customers, who expressed concern that the breach exposed sensitive information, such as IT information and passwords, shared in support cases.

Palo Alto Networks later confirmed to BleepingComputer that the incident was limited to its Salesforce CRM and did not affect any products, systems, or services.

“Palo Alto Networks confirms that it was one of hundreds of customers impacted by the widespread supply chain attack targeting the Salesloft Drift application that exposed Salesforce data,” Palo Alto Networks told BleepingComputer.

“We quickly contained the incident and disabled the application from our Salesforce environment. Our Unit 42 investigation confirms that this situation did not affect any Palo Alto Networks products, systems, or services.”

“The attacker extracted primarily business contact and related account information, along with internal sales account records and basic case data. We are in the process of directly notifying any impacted customers.”

Palo Alto Networks told BleepingComputer that the exfiltrated support case data only contained contact info and text comments, and not technical support files or attachments.

The campaign, first tracked by Google’s Threat Intelligence team as UNC6395, specifically targeted support cases to identify sensitive data, such as authentication tokens, passwords, and cloud secrets, that could be used to pivot into other cloud services and steal data.

“Our observations indicate that the threat actor performed mass exfiltration of sensitive data from various Salesforce objects, including Account, Contact, Case and Opportunity records,” Palo Alto Networks warned in a threat brief shared with BleepingComputer.

“Following exfiltration, the actor appeared to be actively scanning the acquired data for credentials, likely with the intent to facilitate further attacks or expand their access. We have observed that the threat actor deleted queries to hide evidence of the jobs they run, likely as an anti-forensics technique.

Palo Alto Networks states that it has revoked the associated tokens, and rotated the credentials following the incident.

The company recommends Salesloft Drift customers treat the incident with “immediate urgency” and perform the following actions:

Investigate Salesforce, identity provider, and network logs for potential compromise.
Review all Drift integrations for suspicious connections.
Revoke and rotate authentication keys, credentials, and secrets.
Use automated tools, like Trufflehog and Gitleaks, to scan code repositories for embedded authentication keys or tokens.
If data was confirmed to be exfiltrated, it should be reviewed for the presence of credentials.

This week, Zscaler disclosed a data breach that is linked to the recent Salesloft Drift attack. The cybersecurity vendor confirmed it was affected by a campaign targeting Salesloft Drift, a marketing SaaS integrated with Salesforce. Threat actors stole OAuth tokens from the company, the incident impacted multiple Salesforce customers, including Zscaler.

Last week, Google disclosed that the Salesloft Drift OAuth breach is broader than Salesforce, affecting all integrations. GTIG and Mandiant advise all customers to treat connected tokens as compromised. Attackers used stolen OAuth tokens to access some Google Workspace emails on August 9, 2025, via the Drift Email integration. Google stressed this was not a compromise of Workspace itself, and only accounts integrated with Salesloft were at risk, with no access to other customer accounts.

Source: paloaltonetworks and Bleeping computer

Entirely False: Google Confirms Gmail Data Breach Warning Is Fake

 

Check Also

Next.js

Next.js and HashiCorp Vuln Found: Patch Now!

A critical security flaw in the Next.js framework, marked as CVE-2025-29927, lets attackers bypass authorization, …