Klue Supply Chain Breach: OAuth Token Harvesting & Salesforce CRM Data Exfiltration
Klue Supply Chain Breach (TL-2026-0976), also tracked as Klue Breach June 2026, is a critical-severity supply-chain compromise, first published 2026-06-28. It is attributed to Icarus with high confidence, affects Klue Klue Competitive Intelligence Platform, maps to 19 MITRE ATT&CK techniques (T1048, T1059, T1071), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0976
- Threat ID
- TL-2026-0976
- Also known as
- Klue Breach June 2026, Salesforce CRM Data Theft Campaign
- Severity
- CRITICAL
- Status
- RESOLVED
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-28
- Last reviewed
- 2026-06-28
- Attribution
- Icarus
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- financial-services, business-services, professional-services, technology, consulting, sales-and-marketing, insurance, manufacturing
- Target regions
- North America, 155 - Western Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Klue Supply Chain Breach
Malware and tooling: Klue-Backend-OAuth-Harvester, SalesforceAPIAutoExfiltrator, Python Requests Library
Critical supply chain compromise of Klue platform via long-unused backend credential. Attackers deployed malicious Python-based code to harvest OAuth tokens and conduct automated high-volume queries against Salesforce REST APIs (/services/data/v59.0/query and /sobjects endpoints), exfiltrating CRM records, customer contacts, pricing data, and sales communications from multiple customer environments including Salesforce, Gong, SharePoint, HubSpot, and Slack.
How Klue Supply Chain Breach works
In June 2026, the Klue competitive intelligence platform suffered a critical supply chain breach when attackers gained access to backend systems using a long-unused but still-active credential originally created for a discontinued integration project. Following initial compromise, the threat actors deployed malicious code capable of harvesting OAuth tokens that Klue customers had configured for third-party integrations. This code systematically extracted customer OAuth credentials and used them for direct authentication to customer environments. The attackers then leveraged a Python-based automated tool to perform high-volume queries against Salesforce REST API endpoints (/services/data/v59.0/query and /services/data/v59.0/sobjects), executing up to 1,000 API calls within 15-minute windows. This attack pattern enabled the extraction of sensitive Salesforce CRM records including customer accounts, contact information, deal data, pricing details, and internal sales communications. The compromise extended beyond Salesforce to other integrated platforms including Gong (call recording/transcription platform), SharePoint (document repositories), HubSpot (marketing and sales hub), and Slack (collaboration platform), allowing the threat actors to access integrated customer data across the entire SaaS stack. This represents a sophisticated supply chain attack leveraging the trusted integration pathways that modern SaaS platforms depend on for data sharing and workflow automation. The initial access vector—exploitation of dormant credentials from deprecated projects—highlights a critical gap in credential lifecycle management and access review practices. Investigation was completed by June 28, 2026, and the breach was subsequently resolved through credential rotation, malicious code removal, and customer notification.
MITRE ATT&CK techniques used in TL-2026-0976
Exfiltration
T1048 Exfiltration Over Alternative Protocol; T1537 Transfer Data to Cloud Account
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol
Persistence
Defense Evasion
Discovery
T1087 Account Discovery; T1526 Cloud Service Discovery
Collection
T1119 Automated Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Initial Access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
Impact
T1485 Data Destruction; T1486 Data Encrypted for Impact
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Lateral Movement
T1550 Use Alternate Authentication Material
Resource Development
Affected products and versions in Klue Supply Chain Breach
- Klue — Klue Competitive Intelligence Platform
Vulnerable versions: All versions with OAuth integration feature
Fixed in: Patched June 28, 2026 - Salesforce — Salesforce CRM
Vulnerable versions: Any org with Klue integration enabled
Fixed in: Customer-side: credential rotation required - Atlassian — SharePoint
Vulnerable versions: Instances with Klue integration
Fixed in: Customer-side: credential rotation required - HubSpot — HubSpot CRM
Vulnerable versions: Instances with Klue integration
Fixed in: Customer-side: credential rotation required - Gong — Gong Platform
Vulnerable versions: Instances with Klue integration
Fixed in: Customer-side: credential rotation required - Slack — Slack Workspace
Vulnerable versions: Workspaces with Klue integration
Fixed in: Customer-side: credential rotation required
Remediation for Klue Supply Chain Breach
Patches
- Update Klue platform backend to remove OAuth token harvesting code
- Apply security patches addressing credential enumeration vulnerabilities
- Update dependency libraries to patched versions if any known CVEs leveraged
Immediate actions
- Invalidate all OAuth tokens issued to affected customers
- Audit and revoke all long-unused backend credentials and service accounts
- Rotate all API keys and authentication material used by integration services
- Review and remove malicious code from backend systems
- Block any detected IOCs at the perimeter and within customer environments
- Notify all affected customers and implement mandatory re-authentication flows
Workarounds
- Customers should immediately review and rotate Salesforce API integration credentials
- Implement IP whitelisting on Salesforce API access if possible
- Monitor Salesforce API query logs for high-volume unusual queries
- Revoke OAuth tokens for Gong, SharePoint, HubSpot, Slack, and other integrated platforms
- Review data access logs in Slack, SharePoint for unauthorized file access or downloads
Longer-term hardening
- Implement automated credential lifecycle management with scheduled reviews and forced rotation
- Deploy behavioral analytics on API usage patterns to detect high-volume query anomalies
- Establish rate-limiting and quota enforcement on SaaS API endpoints, especially Salesforce
- Implement comprehensive audit logging for all OAuth token issuance and refresh events
- Deploy endpoint detection and response (EDR) with malicious code signature detection
- Establish zero-trust architecture for inter-service and customer integration communication
- Implement real-time alerting on anomalous API query patterns (frequency, scope, data access)
- Require MFA on all backend service credentials and API authentication
- Conduct security code review of all integration and data-access code paths
- Implement data loss prevention (DLP) controls on customer data egress points
Weaknesses (CWE) in Klue Supply Chain Breach
CWE-295, CWE-307, CWE-346, CWE-384, CWE-613, CWE-639, CWE-1390
Timeline of Klue Supply Chain Breach
- Original integration project deprecated and archived, but backend credential left active in system
- Threat actor discovers and compromises long-unused backend credential through credential enumeration or leaked credential sources
- Malicious Python-based code deployed to Klue backend systems to harvest OAuth tokens from customer integrations
- Active token harvesting begins; OAuth tokens for Salesforce, Gong, SharePoint, HubSpot, and Slack are extracted
- Threat actor uses harvested Salesforce OAuth tokens to execute high-volume automated API queries (up to 1,000 calls in 15-minute windows) against /services/data/v59.0/query and /sobjects endpoints
- Using OAuth tokens from other platforms, threat actor accesses customer data in Gong, SharePoint, HubSpot, and Slack
- Klue security team detects unusual API query patterns and high-volume API calls from backend systems
- Incident response team begins investigation; malicious code identified in backend systems
- Malicious code removed; backend credentials rotated; OAuth tokens invalidated; customer notification campaign launched
- Klue publishes incident report and full disclosure; Wiz and Huntress publish detailed threat analysis; investigation concluded
Sources cited for Klue Supply Chain Breach
- Klue Supply Chain Breach Leads to Salesforce Data Exfiltration - Wiz Threat Intelligence
- Klue Breach Analysis - Huntress Threat Detection Report
- Credential Compromise and OAuth Token Theft Risk Analysis
- Salesforce API Security Best Practices and Rate Limiting
- Supply Chain Security and Third-Party Risk Management
- OWASP: OAuth 2.0 Threat Model and Security Considerations
- Defending Against SaaS Integration Attacks
- Credential Lifecycle Management for Cloud Infrastructure
- API Abuse Detection: Behavioral Analytics in Cloud Environments
- Dormant Credential Risk: The Hidden Supply Chain Vector
Threats related to Klue Supply Chain Breach
- Klue OAuth Supply-Chain Breach Enables 'Icarus' Salesforce CRM Data-Theft Extortion Campaign
- LastPass Customer CRM Data Exposed via Klue OAuth Token Theft (Icarus Salesforce Supply-Chain Campaign)
- Klue SaaS Integration Platform OAuth Token Compromise – Multi-Organization Salesforce CRM Access
- ShinyHunters (UNC6040) OAuth Abuse & UNC6395 Salesloft/Drift Supply-Chain Compromise Targeting Salesforce Environments
- Context.ai OAuth Token Compromise: SaaS Integration-Layer Supply Chain Attack
- Infinite Campus Salesforce Breach by ShinyHunters / UNC6040 — 137,100 K-12 School Staff Accounts Exfiltrated and Extorted
Detection coverage for TL-2026-0976
As of 2026-06-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0976 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.