Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks

The Klue breach demonstrates how third-party OAuth integrations can become a critical attack vector when token lifecycle management and permissions are insufficiently controlled. Threat actors leveraged stolen OAuth tokens to silently query Salesforce's REST API over an extended period, highlighting a failure in both token validation and anomalous activity detection. Third-party integrations inherit trust from the platforms they connect to, meaning a compromise in one vendor can cascade into sensitive CRM data exposure for all connected customers. This matters because OAuth tokens, if not scoped minimally and monitored continuously, effectively act as long-lived credentials that bypass traditional authentication controls.