BeyondTrust, LastPass Impacted by Klue-Salesforce Incident
Icarus threat actor leveraged Klue integration to steal data from Salesforce instances of over a dozen companies.
A threat actor named Icarus exploited a vulnerability in Klue's integration with Salesforce, using a compromised legacy credential to gain unauthorized access. The actor then generated OAuth tokens to breach connected Salesforce instances, exfiltrating business contact and CRM data from over a dozen organizations, including LastPass, BeyondTrust, and HackerOne. Salesforce and Gong have disabled the Klue integration, and affected companies are investigating and notifying customers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run LastPass?
Get an email when a new story names LastPass, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA threat actor exploited a compromised legacy credential within Klue's Salesforce integration to generate OAuth tokens, enabling unauthorized access to over a dozen organizations' CRM and contact data. The root failure was the continued existence and use of a stale, unrotated credential tied to a third-party integration — a classic supply chain access control gap. This incident illustrates how a single weak link in a vendor's integration layer can cascade into breaches across multiple downstream customers. It also highlights the danger of OAuth token misuse when initial authentication controls are insufficiently hardened.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- SaaS security posture management (SSPM)
Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Icarus