FlagThis - Latest Cybersecurity News

The threat actor group Icarus executed a supply chain attack by compromising the backend systems of the Klue 'Battlecards' integration service. By harvesting stored OAuth tokens, attackers bypassed traditional perimeter security and multi-factor authentication (MFA) to impersonate the trusted Klue application within customer Salesforce CRM instances. Utilizing the Salesforce REST API, the actors performed bulk exfiltration of sensitive enterprise data, including customer records and sales pipelines. This incident highlights the systemic risk posed by third-party SaaS integrations, where a compromise of a trusted service provider facilitates unauthorized, authenticated access to interconnected enterprise environments.