{"id":8555,"date":"2026-06-22T16:21:05","date_gmt":"2026-06-22T16:21:05","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=8555"},"modified":"2026-06-22T16:21:05","modified_gmt":"2026-06-22T16:21:05","slug":"klue-breach-exposed-salesforce-crm-data-through-stolen-oauth-tokens","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=8555","title":{"rendered":"Klue breach exposed Salesforce CRM data through stolen OAuth tokens"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

An attacker broke into competitive-intelligence vendor Klue, stole OAuth tokens its customers use to connect to Salesforce and other platforms, and accessed data across multiple customer environments prompting the company to revoke customer OAuth tokens and disable affected integrations.<\/p>\n

\u201cAn attacker gained access through a compromised legacy credential associated with an integration service,\u201d Klue CEO Jason Smith said<\/a> in a posting to the company\u2019s blog. \u201cThe attacker used that access to obtain OAuth tokens used to connect Klue with certain third-party platforms, including Salesforce, and subsequently accessed data within a number of connected customer environments,\u201d he wrote.<\/p>\n

Klue detected the intrusion on June 12 and Smith posted to the blog on June 19.<\/p>\n

The breach reached Salesforce accounts at cybersecurity vendors Huntress and Recorded Future, along with an undisclosed number of other Klue customers.<\/p>\n

Salesforce disabled the Klue Battlecards integration and said organizations cannot reconnect through it until further notice, saying in a posting to its website, \u201cOur security teams recently detected unusual activity involving the app that may have resulted in unauthorized access to a subset of customer data via the app\u2019s connection to Salesforce. This issue is limited to Klue\u2019s app connection and does not arise from a vulnerability within the Salesforce platform.\u201d<\/p>\n

Unauthorized code removed<\/h2>\n

Klue\u2019s CEO listed the containment steps the company had taken, including revoking affected credentials and tokens, disabling impacted integrations, notifying law enforcement \u2014 and \u201cremoving unauthorized code.\u201d He offered no further detail on the unauthorized code, how it arrived, or what it did. The company did not immediately respond to a request for further details of its removal of unauthorized code.<\/p>\n

Security vendor and Klue customer Huntress published its own investigation<\/a> filling in that gap. The attackers had pushed a code update to a Klue integration system designed to harvest customers\u2019 OAuth tokens, Huntress wrote. Klue staff later found the \u2018token-theft code\u2019 and removed it, Huntress added in its investigation report.<\/p>\n

The initial entry point was a credential Klue had created to prototype an integration it later dropped but never deactivated. \u201cThe threat actor seems to have leveraged a long-disused but still active credential to conduct the initial compromise \u2014 one that was originally created by Klue for them to prototype a third-party integration they later abandoned,\u201d Huntress said. The attacker then pivoted through Klue\u2019s infrastructure, collected customer tokens and used them to query those customers\u2019 CRM systems before exfiltrating the data, the firm added.<\/p>\n

Klue shut down integrations with Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive and Slack and issued a general alert on June 13, according to Huntress. That alert \u201cdid not indicate which customers were impacted,\u201d the firm noted. It\u00a0did not name any affected customers.<\/p>\n

Data extracted over 24 hours<\/h2>\n

Another security firm, ReliaQuest, traced how customer CRM data was pulled from Salesforce. The attacker authenticated to victims\u2019 Klue integration service accounts, generated OAuth tokens and ran automated Python scripts that queried the Salesforce REST API for about 24 hours, ReliaQuest said in its threat analysis<\/a>.<\/p>\n

The activity was consistent with bulk data retrieval rather than routine integration traffic, it noted \u2014 a distinction that would not have been visible without API-layer logging.<\/p>\n

ReliaQuest advised organizations that had connected Klue to Salesforce to treat the incident as a prompt to revoke and rotate all OAuth tokens and refresh tokens tied to that integration, review Salesforce API logs for unusual query volumes, and restrict third-party integration accounts to known IP ranges.<\/p>\n

\u201cAny third-party app with OAuth access to a core platform like Salesforce<\/a> is part of your attack surface and should be inventoried, monitored, and scoped to least privilege,\u201d the firm said.<\/p>\n

Salesforce and Gong data taken<\/h2>\n

Huntress confirmed it was among the affected customers. Business contacts, price quotes and sales communications from its Salesforce account were taken, the company said. Passwords, payment-card data, threat intelligence and product telemetry were not compromised, and the Huntress product and infrastructure were untouched.<\/p>\n

Parts of the Salesforce account at another cybersecurity vendor, Recorded Future, were also accessed, the company said. \u201cAll available evidence suggests that Recorded Future was not specifically targeted and was instead an incidental victim by virtue of utilizing the compromised integration between Salesforce and Klue,\u201d Recorded Future said<\/a>. The exposure appeared limited to client contact names, email addresses and possibly some contract information, it added.<\/p>\n

Icarus claims the attack<\/h2>\n

Huntress attributed the attack to a new extortion group calling itself Icarus, after session messenger IDs in extortion emails matched identifiers on the group\u2019s dark-web leak site. Icarus listed Klue publicly on June 19 and said it had exfiltrated Salesforce data from a number of Klue\u2019s partner companies. The group has signaled it may contact affected organizations directly, meaning Klue customers should expect unsolicited outreach and review their spam folders for related emails, Huntress said.<\/p>\n

The activity matched the OAuth-abuse pattern behind the 2025 Salesloft Drift and Gainsight compromises, tied to ShinyHunters and UNC6395, but evidence was insufficient to link the Klue incident to either group, the firm said.<\/p>\n

\u201cThe OAuth-abuse playbook is repeatable, effective, and now widely adopted,\u201d it warned.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

An attacker broke into competitive-intelligence vendor Klue, stole OAuth tokens its customers use to connect to Salesforce and other platforms, and accessed data across multiple customer environments prompting the company to revoke customer OAuth tokens and disable affected integrations. \u201cAn attacker gained access through a compromised legacy credential associated with an integration service,\u201d Klue CEO […]<\/p>\n","protected":false},"author":0,"featured_media":8556,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-8555","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8555"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8555"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8555\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/8556"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8555"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8555"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8555"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}