When a vendor's breach becomes yours: lessons from the Klue incident

1. Executive summary

Market intelligence platform Klue suffered a supply-chain intrusion on 11 June 2026 when a threat actor exploited a compromised legacy credential associated with an integration service. The attacker harvested OAuth tokens used to connect Klue to customer environments (Salesforce, Gong, HubSpot, SharePoint, Google Drive), then authenticated directly to downstream customer CRMs to exfiltrate business data. At least twelve organisations have publicly confirmed impact, including multiple cybersecurity vendors (Huntress, ReliaQuest, Recorded Future, Tanium, Jamf, Snyk, HackerOne, Kudelski Security), with Huntress describing the incident as affecting "hundreds" of Klue customers. A new extortion group calling itself "Icarus" has claimed responsibility via its dark-web leak site; the campaign bears hallmarks of prior ShinyHunters activity, but attribution remains unconfirmed. Bottom-line risk for EMEA financial services: any firm using Klue or any other SaaS integration that brokers OAuth tokens to Salesforce/Gong/HubSpot must treat this as an active exposure and audit immediately.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Initial access — legacy integration credential. The attacker gained access to Klue's backend using a compromised legacy credential associated with an integration service. Klue CEO Jason Smith described it as "a compromised legacy credential associated with an integration service." Reporting indicates the credential belonged to an abandoned integration prototype that was never deactivated; the access outlived the project for which it was built.
2. Pivot to integration infrastructure. From the compromised credential, the attacker reached the portion of Klue's infrastructure that brokers connections to customer tools.
3. OAuth token harvesting. The attacker introduced code designed to harvest OAuth tokens used to connect Klue to third-party platforms, including Salesforce. Klue has integrations for Salesforce, Gong, HubSpot, SharePoint, Google Drive, and Zoom; Salesforce is the primary target because it typically holds sensitive financial and PII data.
4. Lateral authentication to customer CRMs. Using the stolen tokens, the attacker authenticated as the discovered service account and queried each customer's CRM data directly — bypassing the need to compromise each customer individually.
5. Data exfiltration. The attacker downloaded CRM data from affected customer Salesforce instances. Huntress reported the stolen data includes business contacts, price quotes, and other sales-related data and messaging; Huntress explicitly stated no threat data, passwords, payment card information, or engineering data was affected.
6. Extortion. Following exfiltration, the attacker emailed affected customers demanding contact via Session messenger under threat of public data release within 48 hours. The extortion email used the subject line "top secret email" and was purportedly sent from "mr bean."

Technical specifics

• Compromised component: Klue integration service; OAuth tokens issued to Klue for downstream platforms (Salesforce, Gong, HubSpot, SharePoint, Google Drive).
• Vulnerability mechanism: Credential exposure (legacy, unrotated) combined with token theft from the integration broker. No CVE is associated with this incident; it is an access-control and secrets-management failure, not a software vulnerability.
• Authentication mechanism abused: OAuth tokens used for standing integrations; the attacker authenticated as the service account rather than as a human user.
• Data scope exfiltrated: CRM records — business contacts, price quotes, sales-related data, messaging. Snyk additionally reported that only the title and description from a limited subset of customer support cases were included; the body/contents of support cases were not.
• Persistence / lateral movement: Persistence was achieved via the harvested OAuth tokens themselves; no separate implant is reported. Lateral movement was logical (token reuse) rather than network-based.
• Command-and-control: Not applicable in the traditional sense; the attacker operated via direct API calls to customer Salesforce instances using stolen tokens.
• Observed impact: Data exfiltration from Salesforce instances of Klue customers; extortion emails demanding contact via Session messenger; at least twelve organisations have publicly confirmed impact.

Caveats and unconfirmed claims

• Attribution to "Icarus" is unconfirmed. A new group calling itself Icarus has claimed the attack via its dark-web leak site. Reporting notes the campaign "has all the hallmarks of a classic ShinyHunters campaign" (prior Salesforce, Salesloft Drift, and Gainsight attacks) and that Icarus "could be a fake persona or an offshoot/collaborator who left the group." Treat the Icarus attribution as unconfirmed; do not act on it as a sole signal.
• Victim count is incomplete. Klue serves more than 250,000 companies worldwide but has not disclosed how many customers were affected. Huntress described itself as among "hundreds" of affected customers. The public victim list will grow as Klue notifies remaining customers.
• Mandiant / CrowdStrike involvement. Klue has engaged CrowdStrike for investigation; Mandiant CTO Charles Carmakal urged organisations using Klue integrations to "immediately audit their systems and monitor application logs for evidence of compromise over the past few weeks. Rotate credentials as appropriate based on the scope of compromise."

4. Mitigation & containment

P1 — within 24 hours

• Inventory Klue integrations. Identify every Klue integration in your Salesforce, Gong, HubSpot, SharePoint, Google Drive, and Zoom environments. Document the OAuth client ID, scopes, and the user/service account it maps to.
• Revoke Klue-issued OAuth tokens. In Salesforce (Setup → App Manager → Connected Apps), revoke any connected app tied to Klue. Repeat for Gong, HubSpot, SharePoint, and Google Drive. Do not rely on Klue's revocation alone; revoke from the customer side.
• Audit Salesforce access logs for the past 30 days. Look for API calls originating from Klue's integration IPs or service accounts, unusual data-export volumes, and logins from unfamiliar geographies. Salesforce Event Monitoring and Login History are the primary sources.
• Block known extortion infrastructure at the mail gateway. Add the extortion email subject "top secret email" and sender display "mr bean" to mail-filter rules; quarantine inbound mail matching these patterns pending review.

P2 — within 72 hours

• Rotate any credentials that may have been stored in Klue. Treat any credential, API key, or token that was ever shared with or stored in Klue as compromised. Rotate in the source system (Salesforce, Gong, HubSpot, etc.) and in any downstream service that consumed it.
• Review Salesforce connected-app OAuth scopes. Reduce scopes to least privilege; remove any connected app that is no longer required.
• Engage Klue contractual notification clauses. Under DORA Art. 30, exercise contractual rights: demand written notification, scope of impact, audit rights, and remediation timeline. Document the request and Klue's response.
• Threat-hunt in CRM data. Search for indicators of the extortion campaign (Session messenger addresses, "top secret email" subject) in mailboxes and CRM notes.

P3 — within 7 days

• Conduct a third-party concentration-risk assessment (DORA Art. 29). Determine whether Klue represents a substitutable integration; if not, document the concentration risk and the compensating controls in place.
• Vendor fix / configuration change. Klue has disconnected all integrations with Salesforce, Gong, HubSpot, SharePoint, and Google Drive and revoked credentials, tokens, and active integrations. Before re-enabling any integration, require Klue to provide a written post-incident report and evidence of credential rotation across its integration infrastructure.
• Update incident response runbooks. Add a "SaaS integration broker compromise" scenario covering OAuth token revocation, downstream CRM log review, and customer-side notification.

5. Indicators of compromise

email-subject  top secret email
email-sender-display  mr bean
threat-actor-alias  Icarus
platform  Klue market intelligence platform
integration-target  Salesforce
integration-target  Gong
integration-target  HubSpot
integration-target  SharePoint
integration-target  Google Drive
integration-target  Zoom

6. Detection

rule AT_2026_06_23_Klue_Extortion_Indicators
{
    meta
        author = "Adverse Trace"
        date = "2026-06-23"
        description = "Strings associated with the Klue supply-chain extortion campaign (Icarus claim, unconfirmed)"
        reference = "https://snyk.io/blog/when-a-vendors-breach-becomes-yours-lessons-from-the-klue-incident/"

    strings:
        $extortion_subject = "top secret email" ascii wide nocase
        $extortion_sender  = "mr bean" ascii wide nocase
        $actor_alias       = "Icarus" ascii wide nocase
        $vendor_name       = "Klue" ascii wide nocase
        $vendor_domain     = "Klue.com" ascii wide nocase

    condition:
        2 of ($extortion_subject, $extortion_sender, $actor_alias, $vendor_name, $vendor_domain)
}

title: Klue OAuth Token Abuse — Suspicious Salesforce API Activity
id: at-2026-06-23-001
status: experimental
description: >
    Detects anomalous Salesforce API activity consistent with the Klue supply-chain
    incident in which stolen OAuth tokens were used to exfiltrate CRM data.
author: Adverse Trace
date: 2026-06-23
reference: https://snyk.io/blog/when-a-vendors-breach-becomes-yours-lessons-from-the-klue-incident/
logsource:
    product: salesforce
    service: event_monitoring
detection:
    selection_api:
        EventType: "API"
        ConnectedApp|contains: "Klue"
    selection_export:
        EventType: "ReportExport"
        ConnectedApp|contains: "Klue"
    timeframe: 30d
    condition: selection_api or selection_export
fields:

    - EventType
    - ConnectedApp
    - UserId
    - ClientIp
    - Query
falsepositives:

    - Legitimate Klue integration usage by authorised teams
level: high

7. Sources

• Snyk — When a vendor's breach becomes yours: lessons from the Klue incident (https://snyk.io/blog/when-a-vendors-breach-becomes-yours-lessons-from-the-klue-incident/) — 23 June 2026
• Help Net Security — Klue breach lead to Salesforce data theft, Huntress affected (https://www.helpnetsecurity.com/2026/06/19/klue-salesforce-data-breach-huntress/) — 19 June 2026
• SecurityWeek — Cybersecurity Firms Impacted by Klue Supply Chain Attack (https://www.securityweek.com/cybersecurity-firms-impacted-by-klue-supply-chain-attack/) — June 2026
• Risky Business News — Risky Bulletin: Klue breach impacts security firms (https://news.risky.biz/risky-bulletin-klue-breach-impacts-security-firms/) — June 2026
• BleepingComputer — Klue OAuth breach victim list grows as Icarus hackers claim attack (https://www.bleepingcomputer.com/news/security/klue-oauth-breach-victim-list-grows-as-icarus-hackers-claim-attack/) — June 2026
• DataBreaches.net — Klue OAuth breach victim list grows as Icarus hackers claim attack (https://databreaches.net/2026/06/21/klue-oauth-breach-victim-list-grows-as-icarus-hackers-claim-attack/) — 21 June 2026
• The Register — Security shops among the 'hundreds' of Klue hack victims (https://www.theregister.com/cyber-crime/2026/06/22/security-shops-among-the-hundreds-of-klue-hack-victims/5259743) — 22 June 2026

8. Adverse Trace position

Severity: High. This is a confirmed supply-chain intrusion at a widely-used SaaS integration broker, with at least twelve organisations publicly confirmed and "hundreds" of Klue customers reportedly affected. The exfiltrated data is CRM/business data rather than credentials or product code, which limits direct downstream compromise, but the blast radius is large and the OAuth-token abuse pattern is repeatable against any SaaS broker with standing integrations. Attribution to "Icarus" is unconfirmed and the campaign bears hallmarks of ShinyHunters activity; we are not acting on the Icarus label as a sole signal. For EMEA financial services clients: any firm using Klue — or any other SaaS integration that brokers OAuth tokens to Salesforce, Gong, HubSpot, SharePoint, or Google Drive — must treat this as an active exposure, revoke tokens from the customer side, audit Salesforce access logs for the past 30 days, and engage DORA/NIS2 third-party risk and incident-classification obligations. We will continue to monitor Klue's notifications and update this advisory as the victim list expands; clients requiring incident-response support should contact the Adverse Trace duty desk.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.