The threat actor group Icarus executed a supply chain attack by compromising the backend systems of the Klue 'Battlecards' integration service. By harvesting stored OAuth tokens, attackers bypassed traditional perimeter security and multi-factor authentication (MFA) to impersonate the trusted Klue application within customer Salesforce CRM instances. Utilizing the Salesforce REST API, the actors performed bulk exfiltration of sensitive enterprise data, including customer records and sales pipelines. This incident highlights the systemic risk posed by third-party SaaS integrations, where a compromise of a trusted service provider facilitates unauthorized, authenticated access to interconnected enterprise environments.

• Incident Overview: Klue-to-Salesforce Breach

  • Target: Klue backend infrastructure and the specifically targeted 'Battlecards' integration service.
  • Primary Impact: Unauthorized, authenticated access to downstream Salesforce CRM environments.
  • Core Risk: The exploitation of trusted third-party service identities to bypass identity perimeters.

• Attack Mechanics: OAuth Token Impersonation

  • Attack Vector: Theft of stored OAuth tokens from Klue’s integration service accounts.
  • Execution Method: Direct querying of Salesforce REST APIs using the stolen, valid tokens.
  • Security Bypass: The use of valid application-level tokens allowed attackers to circumvent MFA and traditional user-login-based security controls.

• Threat Group Profile & Scale of Impact

  • Actor Identity: Icarus, an extortion-focused threat group.
  • Victim Profile: Multiple enterprises, including high-value targets like Managed Service Providers (MSPs) and cybersecurity firms.
  • Data Loss: Bulk exfiltration of sensitive customer records, sales pipelines, and enterprise contact information.
  • Exploitation Window: At least 24 hours of continuous, automated CRM data extraction.

• Detection and Mitigation

  • Platform Action: Salesforce disabled the Klue Battlecards app integration on June 11, 2026, to halt the breach.
  • Detection Indicators: CRM access logs showing high-volume API calls originating from the Klue integration without corresponding user authentication events.
  • Active Threat: Ongoing extortion campaigns leveraging the stolen CRM intelligence.