Scope of Salesforce Attacks Expands as Icarus Leaks Data

The Icarus threat actor exploited compromised OAuth tokens belonging to application vendor Klue to gain unauthorized access to downstream Salesforce customer data, demonstrating how a single third-party compromise can cascade into a widespread supply chain breach. The root issue lies in excessive and insufficiently monitored third-party OAuth permissions, which provided attackers a trusted pathway directly into customer environments without triggering traditional perimeter defenses. This incident underscores that organizations cannot treat their SaaS security perimeter as ending at their own credentials — every integrated vendor represents an extended attack surface. The exfiltration of data across multiple customers amplifies the blast radius significantly, making third-party access governance a critical enterprise risk concern.