After Klue Incident, eSentire Recommends Auditing and Hardening Connected Integrations
Summary
After a threat actor used a compromised legacy credential to steal OAuth tokens and access Klue customers’ connected-platform data, eSentire recommends revoking tokens, auditing access, and hardening integrations.
Key points
- On June 11–12, 2026, a threat actor used a compromised legacy credential to access Klue’s integration infrastructure and harvest customer-authorized OAuth tokens.
- The tokens were used to query and exfiltrate data from connected services, including Salesforce; other affected integrations included HubSpot, SharePoint, Zoom, and Google Drive.
- eSentire said its Salesforce data was accessed, but exposure was minimal; accessed data was limited to business contact and sales metadata.
- eSentire revoked affected tokens, disabled its Klue integration, and audited its Salesforce environment. It reported no identified risk to its customers or services.
- Organizations using Klue should revoke its tokens across all connected platforms, review logs and connected-app permissions, and rotate exposed credentials or secrets.
- For restored integrations, eSentire recommends dedicated least-privilege integration users, restricted OAuth scopes, secure token storage and rotation, and detailed audit logging.
- Recommended investigation logs include API and login events, SOQL query and report-export activity, setup and connected-app audit trails, and third-party integration logs.
Article Details
- Defense Focus
- Scope and remediate unauthorized access through compromised Klue integrations and OAuth tokens, then harden connected applications and monitor their activity.
- Detection Methods
- Review Salesforce API event logs, report-export events, and SOQL query logs to identify queries and data accessed.
- Audit setup, change, user-permission, and Connected App logs for unauthorized changes or access.
- Review login events and history, identity-provider logs, network logs, and Klue authentication activity.
- Monitor OAuth token usage for anomalies and validate token status through introspection and revocation endpoints.
- Audit connected applications, OAuth scopes, and access patterns; investigate evidence of exfiltration or exposed credentials.
- Data Sources
- Salesforce API Event Logs
- Salesforce Login Event Logs and Login History
- Salesforce Report Export events and SOQL Query Logs
- Salesforce Setup Audit Trail and Connected App Audit Trail
- Identity Provider Logs
- Network Logs
- Third-party integration logs, especially Klue authentication activity
- Platforms
- Salesforce
- Defensive Actions
- Revoke Klue OAuth tokens across all connected platforms and disable affected integrations; verify revocation and investigate whether the threat actor was evicted.
- Audit connected apps and remove overly broad OAuth scopes; pre-authorize users through an admin-approved policy and use dedicated, least-privilege integration users.
- Revoke and rotate exposed tokens, secrets, AWS access keys, Snowflake credentials, and third-party API keys stored in Salesforce.
- Reset Salesforce administrator and integration-user passwords, enable MFA, restrict Connected App access by IP, and remove API access from standard profiles unless required.
- Use secure token storage, automatic rotation, shorter expiration periods where feasible, and detailed OAuth audit logging and alerting.
- Test reconnections in a sandbox, restore integrations in stages, and monitor each for 24–48 hours.
- Review integrations and permissions regularly, remove unused connected apps, and collect relevant logs for incident scoping.
MITRE ATT&CK
Vendors
KlueA supply chain attack against competitive intelligence platform Klue led to unauthorized access to Salesforce data belonging to a number of Klue customers. On June 11-12, 2026, a threat actor used a compromised legacySalesforceA supply chain attack against competitive intelligence platform Klue led to unauthorized access to Salesforce data belonging to a number of Klue customers. On June 11-12, 2026, a threat actor used a compromised legacy
Products
KlueA supply chain attack against competitive intelligence platform Klue led to unauthorized access to Salesforce data belonging to a number of Klue customers. On June 11-12, 2026, a threat actor used a compromised legacySalesforceA supply chain attack against competitive intelligence platform Klue led to unauthorized access to Salesforce data belonging to a number of Klue customers. On June 11-12, 2026, a threat actor used a compromised legacy