[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGI3VPitIrpUzDTXo4ggzMCtKLwn2bvYf03-6boHpVVI":3},{"article":4,"iocs":55,"watch_terms":59,"solutions":60,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"b8769fd6-c1d7-4d0c-9056-33480bd2b626","BeyondTrust, LastPass Impacted by Klue-Salesforce Incident","beyondtrust-lastpass-impacted-by-klue-salesforce-incident-f73252","Over a dozen Klue customers have confirmed that hackers stole data from their Salesforce instances. The post BeyondTrust, LastPass Impacted by Klue-Salesforce Incident appeared first on SecurityWeek.","A threat actor named Icarus exploited a vulnerability in Klue's integration with Salesforce, using a compromised legacy credential to gain unauthorized access. The actor then generated OAuth tokens to breach connected Salesforce instances, exfiltrating business contact and CRM data from over a dozen organizations, including LastPass, BeyondTrust, and HackerOne. Salesforce and Gong have disabled the Klue integration, and affected companies are investigating and notifying customers.","Icarus threat actor leveraged Klue integration to steal data from Salesforce instances of over a dozen companies.","https:\u002F\u002Fwww.securityweek.com\u002Fbeyondtrust-lastpass-impacted-by-klue-salesforce-incident\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F05\u002Ffirewall.jpeg","2026-06-24T10:03:06+00:00","2026-06-24T12:00:12.60215+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"Icarus","threat_actor",{"name":21,"type":22},"Salesforce","product",{"name":24,"type":22},"Klue",{"name":26,"type":27},"LastPass","vendor",{"name":29,"type":27},"BeyondTrust",{"name":31,"type":27},"HackerOne","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":32,"icon":34,"name":35,"slug":36},null,"Breaches","breaches",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":18,"context":58},"malware","Threat actor group responsible for the attack",[26,29,31],{"controls":61,"vendors":143},[62,91,114],{"slug":63,"name":64,"problem":65,"products":66},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":92,"name":93,"problem":94,"products":95},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[96,102,107],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":97,"product_name":98,"url":100,"description":101},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":103,"product_name":104,"url":105,"description":106},"falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":109,"url":112,"description":113},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",{"slug":115,"name":116,"problem":117,"products":118},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",[144,149],{"slug":145,"name":29,"logo_path":146,"roles":147},"beyondtrust","\u002Fvendor-logos\u002Fbeyondtrust.png",[148],"affected",{"slug":150,"name":31,"logo_path":151,"roles":152},"hackerone","\u002Fvendor-logos\u002Fhackerone.png",[148],{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":171},"compromised-legacy-credential-in-third-party-integration-leads-to-multi-org-data-breach","Compromised Legacy Credential in Third-Party Integration Leads to Multi-Org Data Breach","A threat actor exploited a compromised legacy credential within Klue's Salesforce integration to generate OAuth tokens, enabling unauthorized access to over a dozen organizations' CRM and contact data. The root failure was the continued existence and use of a stale, unrotated credential tied to a third-party integration — a classic supply chain access control gap. This incident illustrates how a single weak link in a vendor's integration layer can cascade into breaches across multiple downstream customers. It also highlights the danger of OAuth token misuse when initial authentication controls are insufficiently hardened.",[158,159,160,161,162,163,164,165,166,167,168,169,170],"CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 5 – Account Management","CIS Control 16 – Application Software Security","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 SA-9 – External Information System Services","NIST CSF ID.SC-4 – Supply Chain Risk Management","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","ISO\u002FIEC 27001 A.9.4 – System and Application Access Control","ISO\u002FIEC 27001 A.15.1 – Information Security in Supplier Relationships","ITIL Service Design – Information Security Management",{}]