Klue SaaS Integration Platform OAuth Token Compromise – Multi-Organization Salesforce CRM Access
Klue SaaS Integration Platform OAuth Token Compromise (TL-2026-0992), also tracked as Klue June 2026 Breach, is a critical-severity supply-chain compromise, first published 2026-06-28. It is attributed to Icarus with high confidence, affects Klue Klue SaaS Integration Platform, maps to 23 MITRE ATT&CK techniques (T1020, T1071, T1098), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-0992
- Threat ID
- TL-2026-0992
- Also known as
- Klue June 2026 Breach, Icarus Salesforce Campaign
- Severity
- CRITICAL
- Status
- CONTAINED
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-28
- Last reviewed
- 2026-06-28
- Attribution
- Icarus
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- software, cybersecurity, saas, technology, business-intelligence
- Target regions
- North America, Europe, APAC
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Klue SaaS Integration Platform OAuth Token Compromise
Malware and tooling: Icarus OAuth Token Reuse Campaign, Salesforce REST API (api.salesforce.com/services/data/vXX.X/)
Klue's SaaS integration platform suffered a critical supply-chain compromise via a legacy OAuth credential in June 2026, enabling threat actors Icarus and ShinyHunters to gain unauthorized access to Salesforce CRM instances across 11+ customer organizations including Huntress, Recorded Future, and Tanium. Attackers exfiltrated sensitive business intelligence, contact databases, pricing data, sales communications, employee information, and account records using REST API queries before containment.
How Klue SaaS Integration Platform OAuth Token Compromise works
On June 11-12, 2026, Klue, a widely-deployed SaaS platform specializing in CRM and competitive intelligence integrations, was compromised via a legacy OAuth credential (app_id: klue_salesforce_sync) that remained active despite credential rotation protocols and retention deadlines. The compromised credential granted full API authorization to Salesforce REST endpoints without multi-factor authentication or IP allowlisting requirements. Threat actors leveraged the OAuth token to authenticate directly against customer Salesforce orgs, bypassing identity verification by impersonating Klue's legitimate service account. The attack exploited three critical gaps: (1) legacy OAuth credentials retained in Klue's credential store past rotation deadlines, (2) Salesforce REST API query endpoints returning sensitive fields (FirstName, LastName, Email, Phone, Industry, AnnualRevenue, Pricing__c) without additional access controls, and (3) no per-organization rate limiting or anomalous access detection in Klue's monitoring (false negative in telemetry collection). Over the compromise window (~36 hours), attackers executed bulk SOQL queries (SELECT * FROM Contact WHERE ... LIMIT 10000) to extract customer contacts, Account records with financial data, Opportunity records with deal sizes and pipeline status, and internal employee lists from Salesforce global UI (Users endpoint). Secondary threat actor ShinyHunters announced involvement via underground forums, claiming to possess pricing matrices and competitive intelligence from the exfiltrated data. Klue detected the breach through anomalous API query patterns (spike in SOQL LIMIT clauses returning 10K+ record sets per query) and coordinated emergency containment with affected customers. All legacy OAuth tokens were revoked within 4 hours of detection; affected Salesforce instances underwent forced re-authentication and access policy refresh. No evidence of persistent backdoors, C2 callbacks, or destructive activity post-exfiltration.
MITRE ATT&CK techniques used in TL-2026-0992
exfiltration
Command and Control
T1071 Application Layer Protocol
Persistence
Collection
T1114 Email Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Initial Access
T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise; T1199 Trusted Relationship
Impact
T1485 Data Destruction; T1491 Defacement; T1496 Resource Hijacking
Discovery
T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Exfiltration
T1537 Transfer Data to Cloud Account; T1567 Exfiltration Over Web Service
privilege-escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
lateral-movement
T1550 Use Alternate Authentication Material
Reconnaissance
T1589 Gather Victim Identity Information
stealth
Affected products and versions in Klue SaaS Integration Platform OAuth Token Compromise
- Klue — Klue SaaS Integration Platform
Vulnerable versions: all versions using legacy OAuth credentials
Fixed in: patched June 12, 2026 (OAuth token revocation + credential rotation service) - Salesforce — Salesforce CRM
Vulnerable versions: all orgs connected to Klue via OAuth
Fixed in: no patch required; remediation via token revocation and access policy enforcement
Remediation for Klue SaaS Integration Platform OAuth Token Compromise
Patches
- Klue: Deploy OAuth credential lifecycle service (auto-revoke tokens >90 days old)
- Klue: Implement per-customer Salesforce tenant isolation; revoke cross-org token re-use
- Klue: Add SOQL query rate limiting: max 1000 records per query, max 50 queries per hour per org
- Klue: Deploy API request signing and IP allowlisting for all Salesforce token exchange endpoints
Immediate actions
- Revoke all legacy OAuth tokens and SaaS app credentials older than 90 days
- Force re-authentication and session invalidation for all affected Salesforce orgs
- Block API query access from external SaaS integrations; require explicit user authorization per query
- Deploy CRM anomaly detection: alert on SOQL queries returning >5000 records, LIMIT clauses exceeding org baseline, bulk Contact/Account exports
- Audit Salesforce field-level security (FLS) and object-level permissions (OLP) to restrict sensitive fields (pricing, revenue) to authorized users only
- Implement IP allowlisting for SaaS integration endpoints; require Klue to whitelist customer data center IPs only
- Enable Salesforce API usage tracking and set alerts for non-interactive user sessions (service accounts) exceeding query thresholds
Workarounds
- Disable Klue SaaS integration temporarily and export Contact/Account data via Salesforce native export
- Implement field-masking at CRM layer: hide PII and pricing fields from non-human users (service accounts)
- Use Salesforce Connected Apps (managed OAuth) instead of legacy credentials; revoke legacy auth endpoints
Longer-term hardening
- Establish SaaS credential lifecycle management: auto-rotation every 30 days, deprecation warnings at 45 days, revocation at 90 days
- Migrate from OAuth token-based SaaS auth to mTLS (mutual TLS) with certificate pinning for CRM integrations
- Implement zero-trust for SaaS integrations: require scope-limited OAuth grants (e.g., READ:Contact only, not READ:*), short-lived tokens (15-min expiry), and per-org tenant isolation
- Deploy Salesforce Shield (field audit trail, event monitoring) with mandatory PII/pricing field logging
- Conduct SaaS third-party audit: validate security controls, penetration test integration endpoints, require signed security assessment
- Establish cross-org CRM access policy: no SaaS app has blanket access to all records; implement record-level access via sharing rules
- Set up Security Incident Response (SIR) playbook for SaaS compromises: incident classification, data impact assessment template, customer notification timeline
Weaknesses (CWE) in Klue SaaS Integration Platform OAuth Token Compromise
CWE-613, CWE-522, CWE-287, CWE-1021
Timeline of Klue SaaS Integration Platform OAuth Token Compromise
- Attackers execute bulk SOQL queries against Contact, Account, Opportunity, and Users endpoints; extract 10,000+ records per query without rate limiting
- Attackers enumerate accessible Salesforce orgs connected to Klue integration; probe API query limits and data retention policies; identify high-value targets (Huntress, Recorded Future, Tanium)
- Icarus threat actor uses stolen OAuth token to authenticate to Salesforce REST API endpoints on behalf of Klue's service account; bypasses MFA and IP allowlisting
- Klue legacy OAuth credential (app_id: klue_salesforce_sync) becomes active; attackers gain token via credential store breach or insider access to Klue systems
- Klue monitoring systems detect spike in API query patterns; SOQL LIMIT clauses returning abnormally high record sets; Klue SOC initiates incident response
- Exfiltration continues; attackers harvest business contacts, pricing matrices, sales pipeline data, employee information, revenue forecasts from 11+ confirmed organizations
- Salesforce issues trust advisory; Huntress, Recorded Future, and Tanium publish incident notifications and technical remediation guidance; Klue publishes incident post-mortem
- All affected Salesforce organizations undergo forced session invalidation; access policies refreshed; new OAuth tokens issued with tighter scopes and IP allowlists
- Klue revokes all legacy OAuth tokens and forces re-authentication; disables legacy Salesforce integration endpoints; implements emergency rate limiting (1000 records per query)
- Klue confirms unauthorized API access and data exfiltration; estimates ~36-hour compromise window; notifies affected organizations (Huntress, Recorded Future, Tanium, and 8 others)
- ShinyHunters announce involvement via underground forums; claim possession of pricing matrices, competitive intelligence, and customer contact lists; initial extortion demand
- Recorded Future publishes independent technical analysis; confirms Icarus as primary threat actor; ShinyHunters as secondary participant (likely purchased access post-breach)
- SANS Internet Storm Center publishes case study on OAuth token reuse vulnerabilities; CISOs issue guidance on SaaS integration security; third-party risk management frameworks updated
- Legal and regulatory notifications underway; GDPR breach notification process initiated for EU-based customers; class-action lawsuit filed by Huntress and Recorded Future customers
Sources cited for Klue SaaS Integration Platform OAuth Token Compromise
- SOCRadar: Klue Breach – What to Know
- Klue Security Incident Response Statement
- Huntress Breach Notification: Klue Compromise Impact
- ShinyHunters Forum Post: Klue Salesforce Data Access Claim
- Recorded Future Incident Report: Klue OAuth Compromise Technical Analysis
- SANS Internet Storm Center: OAuth Token Reuse in SaaS Integrations – Klue Case Study
- Salesforce Trust Advisory: CRM Integration Security Guidelines Post-Klue
- Tanium Security Update: Data Exposure Scope Assessment – Klue Compromise
Threats related to Klue SaaS Integration Platform OAuth Token Compromise
- Klue Supply Chain Breach: OAuth Token Harvesting & Salesforce CRM Data Exfiltration
- Klue OAuth Supply-Chain Breach Enables 'Icarus' Salesforce CRM Data-Theft Extortion Campaign
- LastPass Customer CRM Data Exposed via Klue OAuth Token Theft (Icarus Salesforce Supply-Chain Campaign)
- ShinyHunters (UNC6040) OAuth Abuse & UNC6395 Salesloft/Drift Supply-Chain Compromise Targeting Salesforce Environments
- Infinite Campus Salesforce Breach by ShinyHunters / UNC6040 — 137,100 K-12 School Staff Accounts Exfiltrated and Extorted
- Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Attack Paths (UNC6040/UNC6240/UNC6395/GRUB1/Storm-3138)
Detection coverage for TL-2026-0992
As of 2026-06-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0992 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.