UNC6395 stole data from Salesforce instances by exploiting compromised OAuth tokens from the Salesloft Drift app.| Google Cloud Blog