BreachPublished 18 Jun 2026

Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks

Source Bleeping Computer

Description

Market intelligence platform Klue suffered a OAuth breach that enabled the "Icarus" threat actors to steal Salesforce CRM data from multiple organizations in an ongoing extortion campaign. [...]

Impact

The breach resulted in unauthorized access and theft of Salesforce CRM data including business contacts, sales communications, price quotes, competitive intelligence reports, and account data from multiple organizations. This exposure risks reputational damage, competitive disadvantage, and potential financial loss due to extortion demands. There is no evidence that passwords, payment card information, or engineering systems were compromised. The stolen OAuth tokens allowed direct API access to customer Salesforce environments, bypassing normal authentication controls.

Defensive guidance

Salesforce has disabled the Klue Battlecards integration to prevent further unauthorized access. Klue has disabled integrations with Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack during the investigation. Organizations using Klue integrations should review Salesforce and related SaaS logs for suspicious activity from known attacker IP addresses, revoke and rotate OAuth tokens, terminate active sessions, and monitor Salesforce API usage for anomalies. Patch status is not applicable as this is a breach involving compromised credentials and integration abuse rather than a software vulnerability with a patch. Organizations should follow vendor advisories and incident response best practices for OAuth token compromise.

References

bleepingcomputer.com/news/security/klue-oauth-breach-linked-to-icarus-salesforce-data-theft-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 Jun 2026, 14:21 UTC

References

Community reviews

Related threats