#github-compromise

[ follow ]
#oauth-token-theft #unc6395 #mandiant-investigation #salesloft #unc6395grub1 #incident-response #aws
#oauth-token-theft
fromIT Pro
1 day ago
Information security

Salesloft Drift hackers had access to company GitHub account for months before attacks

Threat actors accessed Salesloft's GitHub for months, exfiltrated secrets and tokens, then used Drift integrations' OAuth tokens to access customer data.
fromDataBreaches.Net
3 days ago
Information security

Salesloft+Drift Update on Investigation Results - DataBreaches.Net

Threat actor accessed Salesloft GitHub and Drift AWS, stole OAuth tokens to access customer data; environments contained and credentials rotated.
fromIT Pro
1 day ago
Information security

Salesloft Drift hackers had access to company GitHub account for months before attacks

more#oauth-token-theft
fromTheregister
2 days ago

Drift attackers gained entry via a Salesloft GitHub account

The Salesloft Drift breach that compromised "hundreds" of companies including Google, Palo Alto Networks, and Cloudflare, all started with miscreants gaining access to the Salesloft GitHub account in March. This new information comes from a Saturday update into the Mandiant-led investigation - Salesloft hired the incident response firm to determine the root cause and scope of the incident - and a Sunday alert that the integration between Salesloft and Salesforce has now been restored.
Information security
[ Load more ]