{"id":57312,"date":"2026-06-20T01:39:11","date_gmt":"2026-06-20T05:39:11","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=57312"},"modified":"2026-06-20T01:39:11","modified_gmt":"2026-06-20T05:39:11","slug":"klue-oauth-token-theft-icarus","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/klue-oauth-token-theft-icarus\/","title":{"rendered":"Klue confirms OAuth token theft in breach linked to Icarus group"},"content":{"rendered":"

Market intelligence platform Klue<\/a> has formally acknowledged a security breach that led to the theft of OAuth tokens used to connect with customers’ Salesforce environments, an incident now publicly claimed by the newly identified Icarus extortion group. The disclosure, confirmed by Klue CEO Jason Smith, reveals that the attack leveraged a compromised legacy credential associated with an integration service, enabling the threat actor to steal authorization tokens and subsequently access data within multiple connected customer instances of Salesforce.<\/p>\n

Breach Timeline and Initial Discovery<\/h2>\n

Klue detected unauthorized activity on June 12<\/a>, affecting a portion of its integration infrastructure. The company immediately initiated an investigation, engaged CrowdStrike<\/a> for incident response, and began working with external cybersecurity experts. According to Smith, the attacker gained access through a compromised legacy credential related to an integration service. This access was then used to obtain OAuth tokens that facilitate connections between Klue and third-party platforms, most notably Salesforce.<\/p>\n

The investigation confirmed that the attacker used the stolen tokens to access data within a number of connected customer Salesforce environments. Klue has stated that there is currently no evidence indicating that customer content stored directly within the Klue platform was compromised, limiting the scope of the incident to the third-party integrations.<\/p>\n

How the Attack Unfolded: OAuth Token Abuse and Data Exfiltration<\/h2>\n

Cybersecurity firms Huntress and ReliaQuest, who independently investigated the breach, provided detailed technical analysis of the attack methodology. ReliaQuest observed the attackers generating OAuth tokens and deploying Python scripts to query Salesforce\u2019s API over extended periods, systematically extracting CRM data. Huntress confirmed that its own Salesforce instance was among those affected, with stolen data including business contacts, sales communications, pricing information, and other critical business records.<\/p>\n

The attack vector underscores a growing threat in the SaaS ecosystem: the abuse of delegated authentication credentials. By compromising a single integration service credential, the attackers were able to pivot into multiple downstream customer environments, effectively amplifying the scope of a single breach.<\/p>\n

Icarus Extortion Group Steps Forward<\/h2>\n

The Icarus extortion group, previously linked to the operation by BleepingComputer and Huntress, has now publicly claimed responsibility on its data leak site. In a post, the group stated, \u201cAs you’ve probably already heard, Klue.com has been impacted by us recently. A number of other companies’ Salesforce instances, which were partners to Klue, were exfiltrated.\u201d The threat actors are pressuring Klue and affected organizations to contact them through the Session<\/a> messaging platform to prevent the public release of stolen data.<\/p>\n

Huntress independently connected the operation to Icarus by matching Session Messenger IDs used in extortion emails with identifiers on the group\u2019s data leak site. Since the initial reports, a growing list of victims has come forward, including Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity. Almost all affected organizations have confirmed that the incident led to the theft of data from their Salesforce instances but did not impact their own platforms, payment systems, or internal infrastructure.<\/p>\n

The Broader Implications for Third-Party Risk<\/h2>\n

This incident highlights a critical vulnerability in modern enterprise ecosystems: the cascading risk of third-party integrations. When a platform like Klue holds OAuth tokens that grant access to partner systems, a single compromise can expose multiple organizations to data theft. Several affected organizations have warned that the stolen business contact information could fuel follow-on phishing, social engineering, and extortion campaigns, urging customers to remain vigilant.<\/p>\n

What Affected Users and Organizations Should Do Now<\/h2>\n

For any organization that uses Klue or similar integration services, immediate action is required. First, review and rotate all OAuth tokens and credentials associated with third-party integrations, especially those connected to Salesforce. Enable detailed logging for API access to detect unusual query patterns or extended data extraction periods. Deploy a robust security monitoring solution that can detect anomalous OAuth token<\/a> usage, and implement strict access controls on integration services that limit the scope of delegated permissions.<\/p>\n

For individual users whose data may have been exposed in downstream Salesforce instances, remain alert for targeted phishing or social engineering campaigns that leverage stolen business contact information. Use a reputable, no-logs VPN service when accessing corporate networks remotely to add an additional layer of encryption and anonymity. Monitor accounts for any signs of unauthorized access and enable multi-factor authentication on all sensitive platforms immediately.<\/p>\n","protected":false},"excerpt":{"rendered":"

Market intelligence platform Klue has formally acknowledged a security breach that led to the theft of OAuth tokens used to connect with customers’ Salesforce environments, an incident now publicly claimed by the newly identified Icarus extortion group. The disclosure, confirmed by Klue CEO Jason Smith, reveals that the attack leveraged a compromised legacy credential associated […]<\/p>\n","protected":false},"author":7,"featured_media":84792,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/57312.png","fifu_image_alt":"Klue confirms OAuth token theft in breach linked to Icarus group","footnotes":""},"categories":[349],"tags":[],"class_list":["post-57312","post","type-post","status-publish","format-standard","has-post-thumbnail","category-articles"],"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/57312.png","fifu_image_alt":"Klue confirms OAuth token theft in breach linked to Icarus group","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/57312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=57312"}],"version-history":[{"count":0,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/57312\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/84792"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=57312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=57312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=57312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}