Salesloft Drift OAuth Token Breach Leads to Salesforce Data Theft in UNC6395 'Icarus' Attack Campaign

A widespread data theft campaign, tracked as UNC6395 ('Icarus'), targeted over 700 organizations using the Salesloft Drift integration with Salesforce between June 8 and June 18, 2026. The attackers exploited compromised OAuth tokens to gain unauthorized access and systematically exfiltrate large volumes of data, including plaintext credentials.