cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

Klue Confirms OAuth Token Theft in Salesforce Attack Claimed by Icarus

· Original article ↗

Summary

Klue confirmed attackers used a compromised legacy credential to steal OAuth tokens and access connected Salesforce environments. Multiple organizations reported data theft; Icarus claimed responsibility. Klue said its core platform data was not affected.

Key points

  • Klue detected unauthorized activity in its integration infrastructure on June 12.
  • Attackers used a compromised legacy credential to obtain OAuth tokens for connected third-party platforms, including Salesforce.
  • ReliaQuest and Huntress reported attackers used the stolen credentials to query Salesforce and steal data from customer environments.
  • Huntress disclosed that its Salesforce data was affected; other organizations, including Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity, also reported impacts.
  • Klue said it found no evidence that content stored directly on its platform was affected and described the incident as limited to third-party integrations.
  • Klue said it revoked affected credentials and tokens, removed unauthorized code, disabled impacted integrations, and notified law enforcement.
  • Icarus claimed responsibility and threatened to leak stolen data; several organizations warned of possible follow-on phishing and social engineering.

Article Details

Victim Organization
Klue
Victim Domain
Klue.com
Incident Type
Unauthorized access to Klue integration infrastructure using a compromised legacy credential, theft of OAuth tokens, and access to connected customer Salesforce environments resulting in data theft.
Data Types Exposed
  • Business contacts
  • Sales communications
  • Pricing information
  • Other Salesforce records
Affected Records
Not disclosed
Affected Data Size
Not disclosed
Operational Impact
Klue said its core platform data was not affected and the incident was limited to third-party integrations. It revoked affected credentials and tokens, removed unauthorized code, and disabled impacted integrations. Multiple organizations reported Salesforce data theft; they said their own platforms, infrastructure, payment information, or internal systems were not affected.
Ransom Or Extortion
Icarus claimed responsibility and pressured Klue and affected organizations to contact the group through Session to prevent the stolen data from being leaked. The extortion activity is reported; the claim does not independently establish Icarus's responsibility.
Claim Status
confirmed

MITRE ATT&CK

T1528 · Steal Application Access TokenAttackers obtained and used OAuth access tokens after accessing a compromised legacy credential associated with a Klue integration service.

People

Jason SmithKlue CEO who publicly disclosed the incident and described the company's findings about the compromised legacy credential and OAuth token access.

Threat Actors

IcarusThe extortion group publicly claimed responsibility for the Klue-related Salesforce data theft. BleepingComputer and Huntress previously linked the incident to Icarus; Huntress cited Session Messenger IDs and the group's leak site. Responsibility is attributed, not independently confirmed.

Vendors

CrowdStrikeThe company also confirmed it engaged CrowdStrike to assist with the response.SalesforceKlue confirmed unauthorized activity in its integration infrastructure led to stolen OAuth tokens used to access connected Salesforce environments, with only third-party integrations affected.

Products

KlueKlue confirmed unauthorized activity in its integration infrastructure led to stolen OAuth tokens used to access connected Salesforce environments, with only third-party integrations affected.Klue BattlecardsThe disclosure comes after cybersecurity firms Huntress and ReliaQuest detailed how attackers abused compromised Klue Battlecards integrations to steal Salesforce CRM data from multiple organizations.SalesforceKlue confirmed unauthorized activity in its integration infrastructure led to stolen OAuth tokens used to access connected Salesforce environments, with only third-party integrations affected.

Related Articles