Klue OAuth Breach Fuels Salesforce Data Theft Campaign

Cybercriminals exploited a compromised OAuth integration at Klue to access customer data stored in Salesforce environments. Investigators connected the incident to the threat group Icarus, which has targeted multiple organizations in a growing data theft and extortion campaign.

The attack highlights a growing cybersecurity challenge. Instead of attacking Salesforce directly, threat actors increasingly target trusted third-party applications that already have access to valuable business information. By compromising those connections, attackers can bypass many traditional security controls and reach sensitive corporate data.

Attackers Exploited Trusted Salesforce Access

Investigators found that the attackers abused OAuth credentials connected to Klue’s Battlecards integration. Those credentials granted access to Salesforce environments where customers stored CRM data.

After obtaining the tokens, the attackers sent API requests and collected information from affected organizations. They did not need to breach Salesforce itself. Instead, they leveraged a trusted connection that customers had already authorized.

Researchers say this tactic allows threat actors to move quickly while avoiding many detection mechanisms. The attackers relied on legitimate access pathways rather than malware or software vulnerabilities.

Icarus Continues Its Data Theft Campaign

Security researchers linked the incident to Icarus, a threat actor known for targeting organizations that use cloud-based business platforms. The group focuses on stealing corporate information and pressuring victims into paying extortion demands.

Victims reportedly received messages demanding payment after the attackers extracted data. The campaign follows a pattern that researchers have observed across multiple recent incidents involving Salesforce-connected applications.

The attackers continue to favor credential theft and OAuth abuse because those techniques often provide immediate access to valuable data. As more organizations adopt SaaS platforms, threat actors gain additional opportunities to exploit trusted integrations.

Third-Party Integrations Create New Risks

The Klue incident demonstrates how third-party applications can expand an organization’s attack surface. Many companies carefully secure their primary cloud platforms but pay less attention to connected services that hold similar permissions.

Researchers have identified comparable attacks involving other Salesforce integrations in recent months. In each case, attackers targeted a connected application instead of the CRM platform itself. That approach allowed them to access customer information through existing trust relationships.

Organizations often deploy dozens of integrations across their environments. Without regular reviews, those connections can create security blind spots that attackers actively seek to exploit.

Organizations Should Audit OAuth Permissions

Security experts recommend reviewing every application connected to Salesforce and removing integrations that no longer serve a business purpose. Administrators should also audit OAuth permissions and revoke tokens that users no longer need.

Organizations can further reduce risk by monitoring API activity, investigating unusual data exports, and enforcing strong access controls across connected services. Security teams should treat third-party integrations with the same level of scrutiny as their core business platforms.

As cloud ecosystems continue to grow, attackers will likely keep targeting trusted connections that provide direct access to sensitive information.

Conclusion

The Klue OAuth breach shows how attackers can turn trusted integrations into powerful attack vectors. By stealing OAuth tokens, the Icarus group accessed Salesforce data without compromising Salesforce itself. The incident reinforces the need for organizations to monitor connected applications, review permissions regularly, and secure every link in their cloud ecosystem.