# Klue Supply Chain Breach: OAuth Token Harvesting & Salesforce CRM Data Exfiltration

> Critical supply chain compromise of Klue platform via long-unused backend credential. Attackers deployed malicious Python-based code to harvest OAuth tokens and conduct automated high-volume queries against Salesforce REST APIs (/services/data/v59.0/query and /sobjects endpoints), exfiltrating CRM records, customer contacts, pricing data, and sales communications from multiple customer environments including Salesforce, Gong, SharePoint, HubSpot, and Slack.

- **Published:** 2026-06-28T12:00:00Z
- **Last reviewed:** 2026-06-28T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0976
- **ID:** TL-2026-0976
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** RESOLVED
- **Actor:** Icarus
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In June 2026, the Klue competitive intelligence platform suffered a critical supply chain breach when attackers gained access to backend systems using a long-unused but still-active credential originally created for a discontinued integration project. Following initial compromise, the threat actors deployed malicious code capable of harvesting OAuth tokens that Klue customers had configured for third-party integrations. This code systematically extracted customer OAuth credentials and used them for direct authentication to customer environments. The attackers then leveraged a Python-based automated tool to perform high-volume queries against Salesforce REST API endpoints (/services/data/v59.0/query and /services/data/v59.0/sobjects), executing up to 1,000 API calls within 15-minute windows. This attack pattern enabled the extraction of sensitive Salesforce CRM records including customer accounts, contact information, deal data, pricing details, and internal sales communications. The compromise extended beyond Salesforce to other integrated platforms including Gong (call recording/transcription platform), SharePoint (document repositories), HubSpot (marketing and sales hub), and Slack (collaboration platform), allowing the threat actors to access integrated customer data across the entire SaaS stack. This represents a sophisticated supply chain attack leveraging the trusted integration pathways that modern SaaS platforms depend on for data sharing and workflow automation. The initial access vector—exploitation of dormant credentials from deprecated projects—highlights a critical gap in credential lifecycle management and access review practices. Investigation was completed by June 28, 2026, and the breach was subsequently resolved through credential rotation, malicious code removal, and customer notification.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1087 Account Discovery
- T1526 Cloud Service Discovery
- T1550 Use Alternate Authentication Material
- T1119 Automated Collection
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1048 Exfiltration Over Alternative Protocol
- T1537 Transfer Data to Cloud Account
- T1071 Application Layer Protocol
- T1485 Data Destruction
- T1486 Data Encrypted for Impact
- T1583 Acquire Infrastructure
- T1059 Command and Scripting Interpreter

## Sources

- [Klue Supply Chain Breach Leads to Salesforce Data Exfiltration - Wiz Threat Intelligence](https://threats.wiz.io/all-incidents/klue-supply-chain-breach-leads-to-salesforce-data-exfiltration)
- [Klue Breach Analysis - Huntress Threat Detection Report](https://www.huntress.com/blog/klue-breach)
- [Credential Compromise and OAuth Token Theft Risk Analysis](https://auth0.com/blog/oauth-token-theft-and-mitigation)
- [Salesforce API Security Best Practices and Rate Limiting](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/security.htm)
- [Supply Chain Security and Third-Party Risk Management](https://www.cisa.gov/supply-chain-security)
- [OWASP: OAuth 2.0 Threat Model and Security Considerations](https://www.owasp.org/index.php/OAuth_2.0_Threats)
- [Defending Against SaaS Integration Attacks](https://www.darkreading.com/saas-integration-attacks-2026)
- [Credential Lifecycle Management for Cloud Infrastructure](https://www.gartner.com/en/articles/credential-lifecycle-management)
- [API Abuse Detection: Behavioral Analytics in Cloud Environments](https://www.splunk.com/en_us/blog/security/api-abuse-detection.html)
- [Dormant Credential Risk: The Hidden Supply Chain Vector](https://www.mandiant.com/resources/dormant-credentials-risk)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0976