[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1p0YMghsTe6-tqggLy1i6qluiysKp7FvYxz4yh508gg":3},{"article":4,"iocs":55,"watch_terms":59,"solutions":60,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"b53b25cc-4b48-4453-800b-101f27ede610","Salesforce Disables Klue Integration After OAuth Token Theft Hits Customer Data","salesforce-disables-klue-integration-after-oauth-token-theft-hits-customer-data-2b4612","Icarus extortion group used a legacy Klue Battlecards credential to bypass security and steal bulk Salesforce records from affected companies.","The Icarus extortion group exploited a legacy credential in the Klue Battlecards integration to steal bulk Salesforce customer data. Salesforce disabled the integration, and Klue deactived compromised OAuth tokens, but data theft occurred over a 24-hour period. The stolen data includes commercial information like contacts and quotes, but not passwords or payment details.","Icarus extortion group stole Salesforce customer data via compromised Klue integration.","https:\u002F\u002Fhackread.com\u002Fsalesforce-disables-klue-integration-oauth-token-data\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Fsalesforce-disables-klue-integration-oauth-token-data.png","2026-06-22T11:00:33+00:00","2026-06-22T12:00:22.137411+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"Icarus","threat_actor",{"name":21,"type":22},"Salesforce","product",{"name":24,"type":22},"Klue Battlecards",{"name":26,"type":27},"OAuth tokens","technology",{"name":29,"type":22},"HubSpot",{"name":31,"type":22},"Microsoft SharePoint","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":32,"icon":34,"name":35,"slug":36},null,"Breaches","breaches",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":49,"value":57,"context":58},"Python scripts","Used by attackers to fetch data via Salesforce REST API",[21,24,29],{"controls":61,"vendors":146},[62,91,117],{"slug":63,"name":64,"problem":65,"products":66},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":92,"name":93,"problem":94,"products":95},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[96,104,111],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":106,"url":109,"description":110},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":112,"product_name":113,"url":115,"description":116},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"slug":118,"name":119,"problem":120,"products":121},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",[147,153],{"slug":148,"name":149,"logo_path":150,"roles":151},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png",[152],"reported_by",{"slug":154,"name":155,"logo_path":156,"roles":157},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png",[152],{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":176},"legacy-oauth-credential-exploited-in-salesforce-klue-integration-breach","Legacy OAuth Credential Exploited in Salesforce-Klue Integration Breach","The Icarus extortion group exploited a legacy credential within the Klue Battlecards third-party integration to gain unauthorized access to bulk Salesforce customer data. This incident highlights the critical risk posed by stale or unrotated credentials in third-party integrations, which often operate with broad permissions and limited oversight. Data was exfiltrated over a 24-hour window before the breach was detected and contained, demonstrating gaps in real-time monitoring of OAuth token activity. Supply chain integrations frequently inherit excessive trust and access without commensurate security controls, making them attractive targets for attackers. Organizations must treat third-party API and OAuth relationships with the same rigor as internal privileged access.",[163,164,165,166,167,168,169,170,171,172,173,174,175],"CIS Control 5: Account Management","CIS Control 12: Network Infrastructure Management","CIS Control 16: Application Software Security","NIST AC-2: Account Management","NIST AC-6: Least Privilege","NIST IA-5: Authenticator Management","NIST SI-4: System Monitoring","NIST SR-6: Supplier Assessments and Reviews","ISO 27001 A.9.4: System and Application Access Control","ISO 27001 A.15.1: Information Security in Supplier Relationships","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach","ITIL: Service Configuration Management",{}]