# Klue OAuth Supply-Chain Breach Enables 'Icarus' Salesforce CRM Data-Theft Extortion Campaign

> Attackers compromised the backend of competitive-intelligence SaaS vendor Klue via a long-disused but still-active prototype integration credential, pushed a malicious code update that harvested customer OAuth tokens, and used those tokens to query and exfiltrate Salesforce (and other) CRM data from multiple enterprises. The 'Icarus' extortion group (alias 'mr bean') has claimed the campaign and is extorting victims, including Huntress.

- **Published:** 2026-06-18T00:00:00Z
- **Last reviewed:** 2026-06-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0853
- **ID:** TL-2026-0853
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Icarus
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In June 2026 the market-intelligence platform Klue suffered a software supply-chain compromise that was weaponized to steal customer OAuth tokens and pivot directly into connected Salesforce CRM environments. According to Huntress and ReliaQuest analyses, the threat actor gained initial access to Klue's backend on or around June 11, 2026 by abusing a 'long-disused but still active' credential tied to a prototype integration. The attacker then pushed a malicious code update into Klue's integration service that collected the OAuth tokens Klue customers had granted for their third-party connectors (Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack).

Using the stolen OAuth tokens, the attacker authenticated as the compromised Klue integration service account, generated session/access tokens, and ran automated Python scripts (User-Agent 'Python-urllib') against the Salesforce REST API. The operation began with low-and-slow reconnaissance against the object-catalog endpoint '/services/data/v59.0/sobjects' to enumerate available objects, then shifted to high-volume bulk extraction via '/services/data/v59.0/query' with QueryMore cursor pagination. ReliaQuest observed almost a thousand queries concentrated in a single 15-minute burst in one environment and a sustained ~6-hour extraction in another, with the full smash-and-grab spanning roughly a 24-hour window per victim. The attacker alternated between blended, stealthy querying and aggressive harvesting to evade volume-based detection.

The activity is attributed with high confidence to the Icarus extortion group, active since April 28, 2026 and using the alias 'mr bean' (also 'mb'). Icarus posted a 'get ready; big corps getting listed' warning to its dark-web leak site on June 12, issued extortion emails to Huntress staff on June 16 (subject 'top secret email', threatening publication within 48 hours and directing victims to contact them on Session Messenger), and listed a Salesforce-data victim entry whose Session Messenger IDs matched those in the extortion emails. ReliaQuest noted the tradecraft 'closely resembled' prior ShinyHunters and UNC6395 (Salesloft Drift, August 2025) Salesforce-integration attacks but could not definitively attribute, while BleepingComputer and Huntress link it to Icarus. Salesforce responded by disabling the Klue connected app pending investigation. Compromised data at named victims included business contacts, sales communications, price quotes, competitive market reports, and account/deal data; threat-intel telemetry, passwords, payment-card/PCI data, source code, and engineering systems were reported not affected.

This incident continues the 2025-2026 pattern of OAuth/refresh-token abuse against Salesforce ecosystems (ShinyHunters voice-phishing in June 2025; UNC6395 Salesloft Drift token theft in August 2025) and underscores that trusted third-party integrations are among the least-monitored paths to an organization's most sensitive CRM data.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1199 Trusted Relationship
- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1550 Use Alternate Authentication Material
- T1528 Steal Application Access Token
- T1526 Cloud Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1071 Application Layer Protocol
- T1020 Automated Exfiltration
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks](https://www.bleepingcomputer.com/news/security/klue-oauth-breach-linked-to-icarus-salesforce-data-theft-attacks/)
- [Cybercrime Breaches Klue: Salesforce Data Impacted for Many Victims, including Huntress](https://www.huntress.com/blog/klue-breach-investigation)
- [Klue Integration Abused in Salesforce Data Theft — ReliaQuest Threat Spotlight](https://reliaquest.com/blog/threat-spotlight-integration-abused-in-crm-data-theft)
- [Another OAuth Hack: Salesforce Disables Third-Party App as CRM Data Exposed Again](https://www.salesforceben.com/another-oauth-hack-salesforce-disables-third-party-app-as-crm-data-exposed-again/)
- [Salesforce Security Advisories](https://security.salesforce.com/security-advisories)
- [UNC6395 Salesloft Drift OAuth token theft (August 2025 — comparison campaign)](https://www.salesforceben.com/salesforce-data-theft-roundup-everything-you-need-to-know/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0853