AI may be good at finding security vulnerabilities, but it can't beat human stupidity

1. Executive summary

On or around 11 June 2026, threat actors exploited a compromised legacy credential associated with Klue's Salesforce integration to steal OAuth tokens, which were then used to access the Salesforce environments of Klue customers — reportedly hundreds of organisations. The newly emerged data-theft and extortion crew "Icarus" has claimed responsibility and is actively extorting Klue while leaking stolen data from victims including Huntress and LastPass. No CVE data, CISA-KEV entries, or CVSS scores have been resolved for this item — the incident is a credential-management and third-party-integration failure, not a product vulnerability. EMEA financial services that use Klue or depend on third-party platforms holding OAuth tokens to Salesforce should audit integration credentials, revoke stale tokens, and review third-party risk exposure.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain (multi-source corroborated across The Register, Help Net Security, Risky Business News, and Huntress)

1. Initial access — legacy credential compromise. On approximately 11 June 2026, attackers used a compromised legacy credential associated with a Klue integration service. The credential should have been deleted but remained active. The exact mechanism of credential compromise (breach reuse, guessing, phishing) is not specified in the sources.
2. OAuth token theft. Using the compromised credential, attackers accessed Klue's platform and obtained OAuth tokens that Klue customers had issued to connect Klue to third-party services, primarily Salesforce.
3. Customer Salesforce access. Attackers used the stolen OAuth tokens to authenticate directly to customer Salesforce environments, bypassing Klue's platform entirely. They then downloaded CRM data — business contacts, price quotes, sales-related data, leads, and messaging.
4. Data exfiltration. Stolen data varied by victim. Huntress confirmed exposure of business contacts, price quotes, and sales-related data; explicitly stated no threat data, passwords, payment card information, or engineering data related to Huntress Agent or telemetry was affected. LastPass confirmed exposure of customer names, phone numbers, email addresses, physical addresses, case/support data, and sales-related data.
5. Extortion and leaking. The group "Icarus" published stolen data on their dark web leak site and is extorting Klue. Icarus has also warned affected companies to contact them directly if Klue does not pay. Huntress data was leaked a few days after disclosure. LastPass has stated that attackers are "deleting" stolen data, though this claim is unverified.

Attribution — Icarus (unconfirmed)

• Icarus claimed responsibility via an entry on their dark web leak site. The group's leak site has been active since late April 2026.
• IP addresses observed in Europe have been linked to Icarus activity, but these may be Tor or VPN exit nodes — true location is unknown.
• Icarus is described as modelled after Shiny Hunters and Scattered Spider. Shiny Hunters have explicitly denied involvement and stated "we wish" it had been them.
• No MITRE ATT&CK profile exists for Icarus in the verified reference data. Attribution is unconfirmed. Risky Business News notes the incident has "all the hallmarks of a classic ShinyHunters campaign" and speculates Icarus could be a fake persona or offshoot/collaborator.
• This attribution is single-sourced to Icarus's own leak-site claim, corroborated only by Risky Business News's reporting. Verify before enforcement.

Scope of impact

• Klue serves more than 250,000 users worldwide.
• Huntress stated "hundreds" of organisations were affected.
• At least eight companies have confirmed Klue-related breaches as of publication. Known victims include Huntress, LastPass, BeyondTrust, and ReliaQuest.
• Klue is working with CrowdStrike to investigate.
• Klue has other integrations for HubSpot, Zoom, and Google Drive, but attackers targeted Salesforce first because it typically stores sensitive financial and PII details.

Unconfirmed allegations regarding Huntress insider (single-sourced; verify before enforcement)

• A former Huntress security operations analyst posted allegations on LinkedIn claiming a current Huntress employee passed US law enforcement communications to a cyber criminal.
• The ex-employee claims this alleged insider was caught by the FBI but still works at Huntress.
• Huntress CEO acknowledged concerns, stated the company "firmly disagrees" with the insider narrative, and said some matters involve legal proceedings.
• No DOJ arrest notice has been identified. These allegations are unconfirmed and stem from a single source (the ex-employee's LinkedIn posts). They are not directly related to the Klue breach per the ex-employee's own statement.

4. Mitigation & containment

P1 — Within 24 hours

• Audit all OAuth tokens and integration credentials. Identify any third-party platforms (Klue and similar CRM/Salesforce integration tools) that hold OAuth tokens or API credentials for your Salesforce environment. List every integration, its credential age, and its last-used date.
• Revoke all stale or legacy credentials. Any integration credential not in active use must be revoked immediately. In Salesforce: navigate to Setup → Session Management → OAuth Connected Apps; revoke tokens for any unrecognised or unused integrations.
• Rotate all Klue-related credentials and tokens. If your organisation uses Klue, revoke and reissue all integration credentials. Do not reuse existing tokens.
• Review Salesforce login history and OAuth token usage logs. Look for unauthorised access patterns from unfamiliar IP addresses or user agents, particularly between 11–29 June 2026. Check Setup → Login History and Setup → OAuth Token Usage.

P2 — Within 72 hours

• Audit all third-party integration credentials across the estate. Extend beyond Klue to any platform that integrates with Salesforce, HubSpot, Zoom, Google Drive, or similar services via OAuth. Document credential ownership, creation date, and last rotation.
• Implement credential lifecycle policy. Enforce automatic expiration for all integration credentials (e.g., 90-day rotation). Disable and delete credentials for departed employees or decommissioned services.
• Restrict OAuth token scopes. Ensure integration tokens use least-privilege scopes. Tokens used for CRM data sync do not need full Salesforce API access.
• Contact Klue directly if your organisation is a customer. Request confirmation of whether your OAuth tokens were compromised and what data was accessed.

P3 — Within 7 days

• Conduct a third-party risk assessment of all platforms holding OAuth tokens or API credentials to production systems. Evaluate each provider's credential management, incident notification, and breach-response capabilities.
• Implement Salesforce connected-app monitoring. Configure alerts for new OAuth token issuance, token use from new IP ranges, and bulk data export via API.
• Review data classification in Salesforce. Confirm what PII, financial data, and customer records are stored in Salesforce environments accessible via third-party integrations. Restrict sensitive data from being accessible via integration-level permissions.
• Update incident response playbooks to include third-party-originating OAuth token compromise scenarios. Ensure the process covers detection, token revocation, customer notification, and regulatory reporting.

5. Indicators of compromise

No specific IOCs (IP addresses, domains, file hashes, URLs) are present in the source material. The sources reference Icarus's dark web leak site but do not provide a URL, domain, or IP address. IP addresses observed in Europe are mentioned but not enumerated.

No indicators of compromise available in the source material.

6. Detection

The sources do not provide specific file names, registry keys, mutex names, command-line flags, or hard-coded values suitable for YARA rule construction. However, behavioural indicators for Sigma rules can be derived from the attack chain.

title: Suspicious OAuth Token Usage from Third-Party Integration Platform
id: AT-2026-06-29-190-sigma-1
status: experimental
description: Detects Salesforce OAuth token usage consistent with the Klue supply-chain breach pattern — tokens issued to a third-party integration used from unfamiliar IP addresses or user agents, or bulk data access via API.
references:

  - https://www.huntress.com/blog/klue-breach-investigation
  - https://news.risky.biz/risky-bulletin-klue-breach-impacts-security-firms/
  - https://www.helpnetsecurity.com/2026/06/19/klue-salesforce-data-breach-huntress/
author: Adverse Trace
date: 2026/06/29
logsource:
  product: salesforce
  service: event_monitoring
detection:
  selection_token_use:
    eventtype: ApiEvent
    connected_application: "*Klue*"
    source_ip:

      - "*"  # Correlate against known corporate IP ranges; alert on unknown
  selection_bulk_export:
    eventtype: BulkApiResultEvent
    connected_application: "*Klue*"
  selection_new_token:
    eventtype: OAuthTokenAcquisitionEvent
    connected_application: "*Klue*"
  condition: selection_token_use or selection_bulk_export or selection_new_token
falsepositives:

  - Legitimate Klue integration activity from new IP ranges after credential rotation
  - Administrative token reissuance during scheduled maintenance
level: high

title: Third-Party Integration Credential Access to Salesforce CRM Data
id: AT-2026-06-29-190-sigma-2
status: experimental
description: Detects access to Salesforce CRM data (contacts, accounts, opportunities) via OAuth tokens associated with third-party market intelligence or CRM integration platforms, consistent with the Klue breach attack chain.
references:

  - https://www.helpnetsecurity.com/2026/06/24/lastpass-klue-data-breach-salesforce-environment/
  - https://www.bleepingcomputer.com/news/security/lastpass-confirms-data-breach-in-klue-supply-chain-attack/
author: Adverse Trace
date: 2026/06/29
logsource:
  product: salesforce
  service: event_monitoring
detection:
  selection_crm_access:
    eventtype: RestApiEvent
    operation:

      - "query"
      - "queryAll"
      - "retrieve"
    connected_application: "*Klue*"
  filter_known_ips:
    source_ip:

      - "*"  # Replace with known Klue platform IP ranges after verification
  condition: selection_crm_access and not filter_known_ips
falsepositives:

  - Legitimate scheduled CRM data synchronisation by Klue integration
level: medium

7. Sources

• The Register — "AI may be good at finding security vulnerabilities, but it can't beat human stupidity" — https://www.theregister.com/security/2026/06/29/ai-may-be-good-at-finding-security-vulnerabilities-but-it-cant-beat-human-stupidity/5263262 — 2026-06-29
• Help Net Security — "Klue breach lead to Salesforce data theft, Huntress affected" — https://www.helpnetsecurity.com/2026/06/19/klue-salesforce-data-breach-huntress/ — 2026-06-19
• Risky Business News — "Risky Bulletin: Klue breach impacts security firms" — https://news.risky.biz/risky-bulletin-klue-breach-impacts-security-firms/ — 2026-06 (exact date not specified)
• Huntress — "Cybercrime Breaches Klue: Salesforce Data Impacted for Many Victims, including Huntress" — https://www.huntress.com/blog/klue-breach-investigation — 2026-06-18
• SecurityWeek — "BeyondTrust, LastPass Impacted by Klue-Salesforce Incident" — https://www.securityweek.com/beyondtrust-lastpass-impacted-by-klue-salesforce-incident/ — 2026-06 (exact date not specified)
• Help Net Security — "LastPass customer data exposed through Klue supply chain attack" — https://www.helpnetsecurity.com/2026/06/24/lastpass-klue-data-breach-salesforce-environment/ — 2026-06-24
• BleepingComputer — "LastPass confirms data breach in Klue supply chain attack" — https://www.bleepingcomputer.com/news/security/lastpass-confirms-data-breach-in-klue-supply-chain-attack/ — 2026-06 (exact date not specified)

8. Adverse Trace position

This is a significant supply-chain compromise with direct relevance to EMEA financial services that use Klue or similar third-party platforms holding OAuth tokens to Salesforce or other CRM systems. The attack chain is straightforward — legacy credential → OAuth token theft → customer data access — and does not require zero-day exploitation or sophisticated malware. The failure is operational: credential lifecycle management. No CVSS scores or CISA-KEV entries apply because no product vulnerability is involved. Attribution to Icarus is unconfirmed and single-sourced to the group's own leak-site claim; no MITRE ATT&CK profile exists for this actor. The allegations regarding a Huntress insider are separate, unconfirmed, and single-sourced to a former employee's LinkedIn posts. We are monitoring for: (1) the full victim list as Klue completes notifications, (2) any IOCs from Icarus infrastructure, (3) confirmation of whether non-Salesforce integrations (HubSpot, Zoom, Google Drive) were also targeted, and (4) any regulatory filings or enforcement actions related to this incident. Clients using Klue should immediately audit and revoke integration credentials; clients not using Klue should still review their third-party OAuth token estate for similar legacy-credential exposure.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.