Klue Confirms Breach by 'Icarus' Group, Who Abused OAuth Tokens to Access Customer Salesforce Data
New 'Icarus' Extortion Group Hits Klue, Steals Customer Salesforce Data via OAuth Attack
Impact Scope
Affected Companies
Industries Affected
Related Entities(initial)
Threat Actors
Organizations
Products & Tech
Other
Full Report(when first published)
Executive Summary
The market intelligence platform Klue has fallen victim to a security breach orchestrated by a newly identified extortion group calling itself Icarus. The attackers compromised Klue's systems to steal OAuth tokens, which they then used to gain unauthorized access to the integrated Salesforce CRM environments of Klue's customers. This incident is a stark example of a SaaS-to-SaaS (Software-as-a-Service) attack, where the trust relationship between two cloud applications is exploited. The attackers bypassed conventional login mechanisms by using the stolen tokens to make legitimate API calls, allowing them to silently exfiltrate sensitive customer data from Salesforce. This highlights the critical need for stringent auditing and monitoring of third-party application permissions and API activity.
Threat Overview
The attack on Klue and its customers demonstrates a sophisticated understanding of modern cloud application architecture. The threat actor, Icarus, did not need to compromise individual user passwords for Salesforce. Instead, they targeted the authorization mechanism that connects the two platforms.
OAuth is an open standard for access delegation, commonly used to grant applications access to user data on other web services without giving them the passwords. In this case, Klue customers had granted the Klue application a token to access their Salesforce data. The Icarus group compromised Klue's environment and stole these pre-authorized tokens. With a valid token, the attacker's requests to the Salesforce API appear to be legitimate requests coming from the Klue application, making the malicious activity difficult to detect.
Technical Analysis
The attack chain follows a modern cloud-native pattern:
- Initial Compromise: The Icarus group gained access to Klue's production environment. The specific vector is not public but could include exploiting a vulnerability, a misconfiguration, or using compromised developer credentials.
- Credential Access: Once inside Klue's environment, the attackers located and exfiltrated the stored OAuth tokens that Klue uses to interact with its customers' Salesforce instances. This is an application of T1528 - Steal Application Access Token.
- Lateral Movement (SaaS-to-SaaS): The attackers used the stolen tokens to authenticate to the Salesforce API. From Salesforce's perspective, these were valid sessions initiated by the authorized Klue application. This allowed the attackers to move laterally from one compromised SaaS platform (Klue) into another (Salesforce).
- Data Exfiltration: Using the authenticated API access, the attackers queried the Salesforce environments of Klue's customers, exfiltrating sensitive CRM data such as customer lists, sales opportunities, and contact information. This aligns with T1530 - Data from Cloud Storage Object.
This attack vector is particularly dangerous because it abuses a legitimate and necessary function of integrated cloud applications. It bypasses user-facing security controls like MFA and relies on compromising the 'machine' identity (the OAuth token) rather than a 'human' identity.
Impact Assessment
The business impact of this breach is significant for Klue's customers:
- Data Breach: Sensitive and proprietary CRM data, which is often the lifeblood of a sales organization, was stolen. This could include customer lists, deal sizes, contact details, and sales strategies.
- Competitive Disadvantage: If this data is leaked or sold, it could provide competitors with invaluable intelligence.
- Regulatory and Compliance Risk: The exposure of customer data could trigger regulatory investigations and fines under laws like GDPR or CCPA.
- Loss of Trust: The incident erodes trust in both Klue and the security of interconnected SaaS ecosystems in general.
For Klue, the impact includes severe reputational damage, potential legal liability, and the high cost of incident response and remediation.
Detection & Response
Detection:
- API Anomaly Detection: Monitor Salesforce API logs for anomalous activity. Look for an unusual volume of
GETrequests, requests for data types not typically accessed by the integration, or activity originating from unusual IP ranges (if the attacker is not proxying through the original vendor's infrastructure). This is a form of User Behavior Analysis applied to machine identities. - Audit OAuth Grants: Regularly audit all third-party applications granted access to your core SaaS platforms like Salesforce, Microsoft 365, and Google Workspace. Review the permissions granted and revoke access for any unused or overly permissive applications.
- Monitor for Token Misuse: Some advanced Cloud Access Security Broker (CASB) or SaaS Security Posture Management (SSPM) tools can detect anomalous usage of OAuth tokens.
Response:
- Revoke Tokens: Immediately revoke the compromised OAuth tokens within the Salesforce administrative console. This will sever the attacker's access.
- Notify Affected Parties: Notify customers and regulatory bodies as required.
- Investigate Scope: Conduct a thorough investigation of API logs to determine what specific data was accessed and exfiltrated by the attacker.
Mitigation
Immediate Actions:
- Rotate Credentials: All organizations using the Klue-Salesforce integration should immediately revoke the existing OAuth token for the Klue application within Salesforce and generate a new one.
- Audit Permissions: Review the permissions granted to the Klue application (and all other third-party apps). Ensure they adhere to the principle of least privilege, granting only the minimum permissions necessary for the application to function. This aligns with M1018 - User Account Management.
Strategic Improvements:
- SSPM/CASB Implementation: Deploy a SaaS Security Posture Management (SSPM) tool to continuously monitor third-party integrations, permissions, and configurations across your SaaS portfolio.
- Vendor Risk Management: Enhance your vendor onboarding process to include a thorough security assessment of any third-party application before it is granted access to your critical data.
- IP Range Restrictions: Where possible, configure OAuth policies to only allow token usage from a specific, known set of IP addresses belonging to the vendor. This can prevent stolen tokens from being used from an attacker's own infrastructure.
Timeline of Events
Article Updates
June 22, 2026
Severity increasedKlue breach details emerge: initial access via legacy credential, Gong also impacted, and specific high-profile victims like Huntress and Recorded Future named. Incident detected June 11.
New details reveal the Klue supply chain breach originated from a compromised legacy credential, allowing attackers to inject malicious code and harvest OAuth tokens. The Icarus group used these tokens to access not only Salesforce but also Gong environments of customers. High-profile victims now include Huntress, Recorded Future, Tanium, Jamf, Sprout Social, and Insurity. The incident was detected on June 11, 2026, highlighting the cascading risks in interconnected SaaS ecosystems and the need for robust credential management. The report also provides specific cyber observables for detection.
Update Sources:
June 28, 2026
Severity increasedLastPass disclosed a breach originating from the Klue compromise, where stolen OAuth tokens were used to access its Salesforce customer data.
Password manager LastPass has disclosed that it was also impacted by the Klue supply chain attack. Attackers leveraged the previously stolen OAuth tokens from Klue to gain unauthorized access to LastPass's Salesforce environment, compromising customer data. This development significantly increases the scope and impact of the original incident, adding a high-profile victim and further emphasizing the cascading risks of third-party integrations and OAuth token compromise.
Update Sources:
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.