Salesforce has taken the drastic step of disabling the Klue Battlecards app integration after detecting unusual activity that led to the unauthorized access of customer data via the app’s OAuth tokens. The incident, which the company disclosed in a security alert, is not the result of a vulnerability within the Salesforce platform itself but stems from a compromise of the third-party competitive intelligence provider, Klue. This breach has exposed a subset of customer data, including business contacts, price quotes, and sales-related messaging, from organizations that had linked their Salesforce environments to the Klue app.
How the Klue OAuth Token Breach Unfolded
The security incident was first detected by Salesforce’s security teams on June 11, 2026, when they noticed anomalous activity involving the Klue app. Further investigation revealed that a threat actor, operating under the name Icarus, had compromised Klue’s integration infrastructure. According to Klue CEO Jason Smith, the attackers gained initial access through a long-disused but still active legacy credential associated with an integration service. From there, they pivoted into Klue’s systems to steal OAuth tokens that Klue customers use to connect the app to their own platforms, including Salesforce. Once in possession of these tokens, the attackers were able to query the customers’ CRM tools directly, initiating bulk data retrieval actions that lasted for hours.
What Data Was Exposed in the Salesforce-Klue Incident
Huntress, a cybersecurity company and one of the affected Klue customers, confirmed that the data exfiltrated from their Salesforce account included business contacts, price quotes, and other sales-related data and messaging. Critically, Huntress stated that no threat data, passwords, payment card information, or engineering data related to the Huntress agent or telemetry was compromised. This pattern is consistent with the nature of a CRM-focused attack, where the goal is to steal sales intelligence and competitive data rather than sensitive financial or technical secrets. Klue itself has not found evidence that customer content stored within the Klue platform was impacted, limiting the breach to the connected third-party platforms like Salesforce.
The Technical Mechanics of the Third-Party Integration Abuse
Security firm ReliaQuest analyzed the attack and shared technical details about how the threat actor operated. After authenticating through a compromised Klue integration service account, the adversary generated OAuth tokens and ran automated Python scripts, identifiable by Python-urllib user-agent strings. These scripts first enumerated the Salesforce org’s object catalog and then executed a loop of REST API queries against the Salesforce query endpoint, pulling large volumes of CRM records. In one observed case, there was a concentrated burst of nearly a thousand queries in a 15-minute period, with an extraction window lasting more than six hours against a single environment. This level of activity, running from a trusted integration account, did not trigger the usual security alarms because third-party integrations are often monitored far less closely than employee accounts.
What Is the Icarus Threat Group?
Not much is known about the Icarus actor, who has been active only since April 28, 2026, and has claimed just two victims to date. However, the data theft campaign bears a striking resemblance to prior attack waves attributed to groups like ShinyHunters and UNC6395. ReliaQuest noted that the playbook used in this incident mirrors the third-party OAuth-abuse tactics seen in the Salesloft Drift and Gainsight compromises that targeted Salesforce environments in the previous year. The common thread across all these attacks is the exploitation of OAuth tokens or credentials from trusted third-party vendors, which serve as non-human identities with persistent, often broad access to sensitive data.
What Affected Users and Organizations Should Do Now
If your organization uses the Klue Battlecards app within Salesforce, the most immediate action is to recognize that Salesforce has disabled the integration. For those who may have had their data exposed, the primary risk involves the exfiltration of CRM data such as business contacts, sales quotes, and related correspondence. While no passwords or payment card data were reported stolen from the affected customers, the stolen sales intelligence could be used for targeted phishing campaigns, corporate espionage, or competitive intelligence gathering. Affected organizations should immediately review their OAuth token grants, revoke any third-party app tokens that are no longer in use or that belong to dormant integrations, and enforce strict monitoring on all third-party connections to their Salesforce environment. Additionally, enabling multi-factor authentication (MFA) for all integration service accounts and limiting the scope of access granted to third-party apps can help mitigate the risk of similar token theft in the future. For consumers or employees of affected companies, be extra vigilant for spear-phishing emails that may reference business contacts or sales data gleaned from the breach, and report any suspicious communications to your IT security team.
