[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fc6VmfhbUDm7S6-P_GGJoRtmYbZ3-3rj1PXgoC4drjY0":3},{"article":4,"iocs":55,"watch_terms":61,"solutions":62,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"e688dbc2-ba3b-4c0d-b8a1-b2dff1945854","Cybersecurity Firms Impacted by Klue Supply Chain Attack","cybersecurity-firms-impacted-by-klue-supply-chain-attack-cc7d7c","The hackers exfiltrated data from Salesforce instances of Klue customers, such as Huntress and Recorded Future. The post Cybersecurity Firms Impacted by Klue Supply Chain Attack appeared first on SecurityWeek.","Cybersecurity firms Huntress and Recorded Future have confirmed they were impacted by a supply chain attack on the Klue market intelligence platform. The attackers compromised Klue's backend, pushing a malicious code update to harvest OAuth tokens and exfiltrate customer data from Salesforce integrations. While the impact was limited to business and sales-related data, the incident highlights ongoing risks in software integrations.","Klue platform integration with Salesforce compromised, impacting cybersecurity firms Huntress and Recorded Future.","https:\u002F\u002Fwww.securityweek.com\u002Fcybersecurity-firms-impacted-by-klue-supply-chain-attack\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Fsupply-chain-threat.webp","2026-06-19T09:19:06+00:00","2026-06-19T10:00:27.511758+00:00",8,[17,20,22,25,27,30],{"name":18,"type":19},"Klue","product",{"name":21,"type":19},"Salesforce",{"name":23,"type":24},"Huntress","vendor",{"name":26,"type":24},"Recorded Future",{"name":28,"type":29},"Mr Brean","threat_actor",{"name":31,"type":29},"Icarus","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,59],{"type":57,"value":28,"context":58},"malware","Threat actor name associated with extortion communication.",{"type":57,"value":31,"context":60},"Extortion group believed to be responsible for the Klue compromise.",[23,26,18],{"controls":63,"vendors":148},[64,90,119],{"slug":65,"name":66,"problem":67,"products":68},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[69,76,84],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":71,"url":74,"description":75},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":85,"product_name":86,"url":88,"description":89},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"slug":91,"name":92,"problem":93,"products":94},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"slug":120,"name":121,"problem":122,"products":123},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[149,154],{"slug":150,"name":23,"logo_path":151,"roles":152},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[153],"affected",{"slug":155,"name":26,"logo_path":156,"roles":157},"recorded-future","\u002Fvendor-logos\u002Frecorded-future.png",[153],{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":174},"klue-supply-chain-attack-exposes-oauth-token-harvesting-risk","Klue Supply Chain Attack Exposes OAuth Token Harvesting Risk","Attackers compromised Klue's backend infrastructure and injected malicious code into a platform update, enabling them to silently harvest OAuth tokens from connected customer environments. This granted unauthorized access to Salesforce integrations, resulting in the exfiltration of business and sales data from affected firms including Huntress and Recorded Future. The incident underscores a critical blind spot: organizations inherently trust their software vendors, often granting them broad integration permissions without adequate monitoring. Even security-mature organizations are not immune when the compromise originates upstream in the supply chain. This attack is a reminder that third-party integrations represent an expanded attack surface that must be actively managed and audited.",[163,164,165,166,167,168,169,170,171,172,173],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST AC-6: Least Privilege","NIST SI-7: Software, Firmware, and Information Integrity","NIST SR-6: Supplier Assessments and Reviews","GDPR Article 28: Processor Obligations and Third-Party Contracts","GDPR Article 32: Security of Processing","ISO 27001 Annex A.15: Supplier Relationships","ITIL Service Management: Third-Party and Supplier Management",{}]