Compromised OAuth Tokens Exposed Google Workspace Email Accounts

By Medha Cloud Security Desk

A recent data-theft campaign has shown how easily a trusted integration can become the weakest link in cloud security. Attackers exploited OAuth tokens used by third-party tools — notably the Drift Email and Salesloft integrations — to access a limited number of Google Workspace and Salesforce accounts. (Google Cloud Threat Intelligence)

Unlike a password breach, this incident required no phishing or malware. The attackers simply reused valid authentication tokens issued by the integrations themselves. Those tokens granted the same privileges as the authorized user — including the ability to read emails, pull contact data, and interact with connected services.

Security analysts said the episode underscores an uncomfortable truth about cloud ecosystems: organizations may secure their own accounts, yet still inherit the vulnerabilities of the apps they connect to. OAuth tokens are designed for convenience — persistent authorization without re-authentication — but in practice they can outlive the users or permissions they were meant to represent.

For companies relying on Google Workspace for business-critical communication, the breach serves as a reminder that trust must be continuously verified, not permanently granted. When integrations number in the dozens or hundreds, even one exposed key can create a path to sensitive correspondence or customer records.

Google revoked affected tokens and said only a small set of customers were impacted. Still, the incident highlights how indirect attacks — through integrations, plug-ins, or partner systems — are increasingly replacing direct credential theft. In the age of cloud automation, compromise often travels sideways.

Organizations reevaluating their collaboration platforms are beginning to weigh how much control they truly have over connected services.
Microsoft 365 offers more unified identity protection, tenant-level OAuth governance, and granular admin consent policies that make third-party access transparent and auditable.

Medha Cloud helps businesses migrate to Microsoft 365 securely, ensuring continuity while tightening control over data access and external integrations.

→ Learn more about Microsoft 365 Migration Services