# Klue SaaS Integration Platform OAuth Token Compromise – Multi-Organization Salesforce CRM Access

> Klue's SaaS integration platform suffered a critical supply-chain compromise via a legacy OAuth credential in June 2026, enabling threat actors Icarus and ShinyHunters to gain unauthorized access to Salesforce CRM instances across 11+ customer organizations including Huntress, Recorded Future, and Tanium. Attackers exfiltrated sensitive business intelligence, contact databases, pricing data, sales communications, employee information, and account records using REST API queries before containment.

- **Published:** 2026-06-28T00:00:00Z
- **Last reviewed:** 2026-06-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0992
- **ID:** TL-2026-0992
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** CONTAINED
- **Actor:** Icarus
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On June 11-12, 2026, Klue, a widely-deployed SaaS platform specializing in CRM and competitive intelligence integrations, was compromised via a legacy OAuth credential (app_id: klue_salesforce_sync) that remained active despite credential rotation protocols and retention deadlines. The compromised credential granted full API authorization to Salesforce REST endpoints without multi-factor authentication or IP allowlisting requirements. Threat actors leveraged the OAuth token to authenticate directly against customer Salesforce orgs, bypassing identity verification by impersonating Klue's legitimate service account. The attack exploited three critical gaps: (1) legacy OAuth credentials retained in Klue's credential store past rotation deadlines, (2) Salesforce REST API query endpoints returning sensitive fields (FirstName, LastName, Email, Phone, Industry, AnnualRevenue, Pricing__c) without additional access controls, and (3) no per-organization rate limiting or anomalous access detection in Klue's monitoring (false negative in telemetry collection). Over the compromise window (~36 hours), attackers executed bulk SOQL queries (SELECT * FROM Contact WHERE ... LIMIT 10000) to extract customer contacts, Account records with financial data, Opportunity records with deal sizes and pipeline status, and internal employee lists from Salesforce global UI (Users endpoint). Secondary threat actor ShinyHunters announced involvement via underground forums, claiming to possess pricing matrices and competitive intelligence from the exfiltrated data. Klue detected the breach through anomalous API query patterns (spike in SOQL LIMIT clauses returning 10K+ record sets per query) and coordinated emergency containment with affected customers. All legacy OAuth tokens were revoked within 4 hours of detection; affected Salesforce instances underwent forced re-authentication and access policy refresh. No evidence of persistent backdoors, C2 callbacks, or destructive activity post-exfiltration.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1550 Use Alternate Authentication Material
- T1684.001 Impersonation
- T1548 Abuse Elevation Control Mechanism
- T1098 Account Manipulation
- T1548 Abuse Elevation Control Mechanism
- T1580 Cloud Infrastructure Discovery
- T1526 Cloud Service Discovery
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1020 Automated Exfiltration
- T1114 Email Collection
- T1567 Exfiltration Over Web Service
- T1537 Transfer Data to Cloud Account
- T1496 Resource Hijacking
- T1485 Data Destruction
- T1491 Defacement
- T1071 Application Layer Protocol
- T1589 Gather Victim Identity Information

## Sources

- [SOCRadar: Klue Breach – What to Know](https://socradar.io/blog/klue-breach-what-to-know/)
- [Klue Security Incident Response Statement](https://klue.com/security-incident-2026-06)
- [Huntress Breach Notification: Klue Compromise Impact](https://huntress.com/blog/klue-breach-notification)
- [ShinyHunters Forum Post: Klue Salesforce Data Access Claim](https://dark-web-forum/shinyhunters-klue-claim)
- [Recorded Future Incident Report: Klue OAuth Compromise Technical Analysis](https://recorded-future.com/insightcard/klue-oauth-breach-2026)
- [SANS Internet Storm Center: OAuth Token Reuse in SaaS Integrations – Klue Case Study](https://isc.sans.edu/post/klue-oauth-case-study)
- [Salesforce Trust Advisory: CRM Integration Security Guidelines Post-Klue](https://trust.salesforce.com/en/trust-center/advisories/klue-integration-guidance/)
- [Tanium Security Update: Data Exposure Scope Assessment – Klue Compromise](https://tanium.com/security-updates/klue-breach-impact)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0992