UNC6395 Salesforce Data Theft Activity

Matt Brady@mbrady5299

•updated Aug 26, 2025•7•3•144

Detects data theft activity from Salesforce instances by the threat actor UNC6395, who leveraged compromised OAuth tokens associated with the Salesloft Drift third-party application. The detection is based on suspicious user agents and known malicious IP addresses used by the threat actor, specifically targeting the 'Drift' connected application.