About:
A confirmed compromise of Klue’s integration infrastructure enabled attackers to abuse OAuth tokens and access data in connected third-party platforms, including Salesforce environments. The incident, linked to the Icarus extortion group, involved unauthorized API activity and data exfiltration from CRM systems. Organizations using Klue integrations should revoke tokens, review access logs, and audit for suspicious API usage.
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
PoC or Exploitation:
Active compromise and data exfiltration are confirmed. Klue disclosed that it identified unauthorized activity affecting part of its integration infrastructure on June 12, 2026. The attacker gained access through a compromised legacy credential associated with an integration service, obtained OAuth tokens used to connect Klue with third-party platforms including Salesforce, and accessed data in connected customer environments.
The activity has been associated in public reporting with the Icarus extortion group. Huntress reported that Icarus listed Klue on its leak site and claimed that Salesforce instances belonging to Klue partners had been exfiltrated.
Update / Patch:
Klue stated that it revoked affected credentials and tokens, removed unauthorized code, disabled potentially impacted integrations, launched a comprehensive investigation, notified law enforcement, and engaged CrowdStrike to support the investigation and response.
Salesforce disabled the Klue Battlecards app integration after detecting unusual activity involving the app. Salesforce stated that the issue was limited to Klue's app connection and did not arise from a vulnerability in the Salesforce platform.
Affected environments may include organizations that connected Klue integrations to Salesforce or other third-party platforms using OAuth-based access. Klue stated that, based on its investigation to date, the incident was limited to affected third-party platforms and there was no evidence that customer content stored within the Klue platform was impacted.
Description:
Klue is a competitive intelligence and sales enablement platform that integrates with customer business systems, including CRM platforms. In this incident, an attacker reportedly abused a compromised legacy credential tied to Klue integration infrastructure to obtain OAuth tokens for connected third-party platforms. Those tokens were then used to access data in customer environments, including Salesforce.
Huntress disclosed that data copied from its Salesforce account included business contacts, price quotes, other sales-related data, and messaging. Huntress stated that threat data, passwords, payment card information, engineering data, Huntress agent data, and telemetry were not affected.
ReliaQuest reported that observed attacker activity involved authentication through a compromised Klue integration service account, OAuth token generation, and automated Python scripts using Python-urllib user-agent strings. The activity included Salesforce REST API enumeration through /services/data/v59.0/sobjects, repeated queries against /services/data/v59.0/query, and pagination using QueryMore cursors over extended periods.
Observed targets include:
Mitigation Recommendation:
Organizations using Klue integrations should immediately review whether Klue was connected to Salesforce or other third-party platforms and validate whether their tenant was included in Klue's customer notifications.
Revoke and reauthorize Klue-related OAuth grants and app connections where applicable.
Rotate credentials and secrets associated with affected integrations including:
Perform retrospective hunting for:
Recommended response actions:
Restrict third-party integrations that maintain broad or persistent CRM access until permissions and monitoring are reviewed.
References:
https://klue.com/blog/an-update-on-recent-klue-security-incident
https://reliaquest.com/blog/threat-spotlight-integration-abused-in-crm-data-theft/
https://status.salesforce.com/generalmessages/20000257
https://www.huntress.com/blog/klue-breach-investigation
https://www.recordedfuture.com/blog/klue-security-incident
https://www.jamf.com/blog/klue-incident/