Klue OAuth Supply-Chain Breach Enables 'Icarus' Salesforce CRM Data-Theft Extortion Campaign

Klue OAuth Supply-Chain Breach Enables 'Icarus' Salesforce (TL-2026-0853), also tracked as Icarus Salesforce extortion campaign, is a high-severity supply-chain compromise, first published 2026-06-18. It is attributed to Icarus with high confidence, affects Klue Klue competitive-intelligence platform (Battlecards integration /, maps to 17 MITRE ATT&CK techniques (T1020, T1059, T1071), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-0853

Threat ID
TL-2026-0853
Also known as
Icarus Salesforce extortion campaign, Klue Battlecards integration abuse
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-06-18
Last reviewed
2026-06-18
Attribution
Icarus
Attribution confidence
HIGH
Motivation
FINANCIAL
Target sectors
technology, cybersecurity, saas, enterprise-sales
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
18

Attackers compromised the backend of competitive-intelligence SaaS vendor Klue via a long-disused but still-active prototype integration credential, pushed a malicious code update that harvested customer OAuth tokens, and used those tokens to query and exfiltrate Salesforce (and other) CRM data from multiple enterprises. The 'Icarus' extortion group (alias 'mr bean') has claimed the campaign and is extorting victims, including Huntress.

How Klue OAuth Supply-Chain Breach Enables 'Icarus' Salesforce works

In June 2026 the market-intelligence platform Klue suffered a software supply-chain compromise that was weaponized to steal customer OAuth tokens and pivot directly into connected Salesforce CRM environments. According to Huntress and ReliaQuest analyses, the threat actor gained initial access to Klue's backend on or around June 11, 2026 by abusing a 'long-disused but still active' credential tied to a prototype integration. The attacker then pushed a malicious code update into Klue's integration service that collected the OAuth tokens Klue customers had granted for their third-party connectors (Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack).

Using the stolen OAuth tokens, the attacker authenticated as the compromised Klue integration service account, generated session/access tokens, and ran automated Python scripts (User-Agent 'Python-urllib') against the Salesforce REST API. The operation began with low-and-slow reconnaissance against the object-catalog endpoint '/services/data/v59.0/sobjects' to enumerate available objects, then shifted to high-volume bulk extraction via '/services/data/v59.0/query' with QueryMore cursor pagination. ReliaQuest observed almost a thousand queries concentrated in a single 15-minute burst in one environment and a sustained ~6-hour extraction in another, with the full smash-and-grab spanning roughly a 24-hour window per victim. The attacker alternated between blended, stealthy querying and aggressive harvesting to evade volume-based detection.

The activity is attributed with high confidence to the Icarus extortion group, active since April 28, 2026 and using the alias 'mr bean' (also 'mb'). Icarus posted a 'get ready; big corps getting listed' warning to its dark-web leak site on June 12, issued extortion emails to Huntress staff on June 16 (subject 'top secret email', threatening publication within 48 hours and directing victims to contact them on Session Messenger), and listed a Salesforce-data victim entry whose Session Messenger IDs matched those in the extortion emails. ReliaQuest noted the tradecraft 'closely resembled' prior ShinyHunters and UNC6395 (Salesloft Drift, August 2025) Salesforce-integration attacks but could not definitively attribute, while BleepingComputer and Huntress link it to Icarus. Salesforce responded by disabling the Klue connected app pending investigation. Compromised data at named victims included business contacts, sales communications, price quotes, competitive market reports, and account/deal data; threat-intel telemetry, passwords, payment-card/PCI data, source code, and engineering systems were reported not affected.

This incident continues the 2025-2026 pattern of OAuth/refresh-token abuse against Salesforce ecosystems (ShinyHunters voice-phishing in June 2025; UNC6395 Salesloft Drift token theft in August 2025) and underscores that trusted third-party integrations are among the least-monitored paths to an organization's most sensitive CRM data.

MITRE ATT&CK techniques used in TL-2026-0853

Exfiltration

T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078 Valid Accounts; T1195 Supply Chain Compromise; T1199 Trusted Relationship

Persistence

T1098 Account Manipulation

Collection

T1213 Data from Information Repositories; T1530 Data from Cloud Storage

Discovery

T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery

Credential Access

T1528 Steal Application Access Token

lateral-movement

T1550 Use Alternate Authentication Material

Resource Development

T1583 Acquire Infrastructure; T1586 Compromise Accounts

Impact

T1657 Financial Theft

Affected products and versions in Klue OAuth Supply-Chain Breach Enables 'Icarus' Salesforce

  • Klue — Klue competitive-intelligence platform (Battlecards integration / backend integration service)
    Vulnerable versions: backend integration service as of June 11, 2026
    Fixed in: pending vendor remediation; Salesforce connected app disabled
  • Salesforce — Salesforce CRM (REST API v59.0 via Klue connected app)
    Vulnerable versions: orgs with the Klue connected app authorized
    Fixed in: Klue connected app disabled by Salesforce pending investigation

Remediation for Klue OAuth Supply-Chain Breach Enables 'Icarus' Salesforce

Patches

  • No CVE/vendor patch applies; remediation is credential revocation and connected-app review. Salesforce disabled the Klue connected app pending investigation.

Immediate actions

  • Revoke and rotate all OAuth tokens, refresh tokens, and OAuth grants for the Klue integration in Salesforce and every connected SaaS app
  • Reset the Klue integration service-account password and client secrets (password reset alone does NOT invalidate refresh tokens — revoke the tokens explicitly)
  • Terminate/revoke all active sessions for affected services (Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, Slack)
  • Block the four attacker IPs (138.226.246.94, 212.86.125.24, 213.111.148.90, 94.154.32.160) at the perimeter and in SaaS IP allowlists
  • Search email inboxes and spam folders for Icarus extortion messages (subjects 'top secret email' / 'wrong session lol', Session Messenger contact)

Workarounds

  • Disconnect/disable the Klue connected app in Salesforce and other SaaS platforms until the vendor confirms remediation
  • Request and review integration-side and CRM logs from vendors (Salesforce, Gong, etc.) for the published IOC IPs

Longer-term hardening

  • Implement IP allowlisting on all third-party integration accounts and SIEM/SOAR API access, restricting to approved infrastructure only
  • Continuously monitor Salesforce REST API logs for anomalous query volumes, QueryMore pagination loops, Python-urllib user-agents, and unfamiliar source IPs
  • Apply least-privilege scoping to OAuth connected-app permissions; remove unused/prototype integrations and stale credentials
  • Adopt SaaS Security Posture Management (SSPM) to inventory and watch OAuth grants across the integration estate

Weaknesses (CWE) in Klue OAuth Supply-Chain Breach Enables 'Icarus' Salesforce

CWE-1395, CWE-522, CWE-1059, CWE-672, CWE-306

Timeline of Klue OAuth Supply-Chain Breach Enables 'Icarus' Salesforce

  • Icarus extortion group becomes active per its own leak-site claim; alias 'mr bean'.
  • Icarus lists its first known victim on the leak site with the message 'shawty sorry for leaking ur data. dm to resolve.'
  • Threat actor compromises Klue backend systems via a long-disused but still-active prototype integration credential; anomalous activity in the integration system begins.
  • Klue detects unusual network connections; Icarus posts 'get ready; big corps getting listed' to its dark-web leak site.
  • Klue issues a general alert to customers (no specific victims named).
  • Icarus extortion emails arrive at Huntress staff inboxes (subject 'top secret email', 48-hour deadline); a Salesforce-data victim entry is published whose Session IDs match the emails.
  • Huntress publishes a detailed incident report confirming compromise of CRM business contacts, sales comms, price quotes, and competitive reports.
  • BleepingComputer and ReliaQuest publish analyses; Salesforce disables the Klue connected app pending investigation.

Sources cited for Klue OAuth Supply-Chain Breach Enables 'Icarus' Salesforce

Threats related to Klue OAuth Supply-Chain Breach Enables 'Icarus' Salesforce

Detection coverage for TL-2026-0853

As of 2026-06-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0853 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats