A group tracked as UNC6395 engaged in widespread data theft via compromised OAuth tokens from a third-party app called Salesloft Drift.
First seen on darkreading.com
Jump to article: www.darkreading.com/cyberattacks-data-breaches/google-salesforce-attacks-third-party-app
