[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5Z9Tojcp-zxHhpEsFIER914Qydp5PWKy5wTxQk0fr6c":3},{"article":4,"iocs":51,"watch_terms":55,"solutions":56,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"4328a2f0-4d5f-421f-8fd7-4ff5a0fc088f","Scope of Salesforce Attacks Expands as Icarus Leaks Data","scope-of-salesforce-attacks-expands-as-icarus-leaks-data-3f9fd0","More victims have emerged after attackers breached application vendor Klue and used its OAuth tokens to steal customers' Salesforce data.","The scope of recent attacks has widened as the Icarus threat actor claims to have exfiltrated data from multiple Salesforce customers. The attackers initially compromised application vendor Klue, exploiting its OAuth tokens to gain unauthorized access to customer data stored within Salesforce. This incident highlights the risks associated with third-party access and the potential for supply chain attacks to impact downstream customers.","Salesforce data stolen via Klue OAuth token breach, Icarus threat actor claims responsibility.","https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fscope-salesforce-attacks-expands-icarus-leaks-data","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fbltbcd2c419f66a3c63\u002F6a3ae54669022cd7ac4f9ae3\u002Fdatatheft-mikkelwilliam-Getty-2152310845.jpg?width=720&quality=80&disable=upscale","2026-06-23T20:44:09+00:00","2026-06-23T22:00:35.473119+00:00",8,[17,20,22,25],{"name":18,"type":19},"Salesforce","product",{"name":21,"type":19},"OAuth tokens",{"name":23,"type":24},"Klue","vendor",{"name":26,"type":27},"Icarus","threat_actor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":28,"icon":30,"name":31,"slug":32},null,"Breaches","breaches",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[52],{"type":53,"value":26,"context":54},"malware","Threat actor group claiming responsibility for the Salesforce data theft.",[23,18,21],{"controls":57,"vendors":139},[58,87,110],{"slug":59,"name":60,"problem":61,"products":62},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":88,"name":89,"problem":90,"products":91},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[92,98,105],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":93,"product_name":94,"url":96,"description":97},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":100,"url":103,"description":104},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":106,"product_name":107,"url":108,"description":109},"falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"slug":111,"name":112,"problem":113,"products":114},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":161},"oauth-token-abuse-in-third-party-app-enables-salesforce-data-exfiltration","OAuth Token Abuse in Third-Party App Enables Salesforce Data Exfiltration","The Icarus threat actor exploited compromised OAuth tokens belonging to application vendor Klue to gain unauthorized access to downstream Salesforce customer data, demonstrating how a single third-party compromise can cascade into a widespread supply chain breach. The root issue lies in excessive and insufficiently monitored third-party OAuth permissions, which provided attackers a trusted pathway directly into customer environments without triggering traditional perimeter defenses. This incident underscores that organizations cannot treat their SaaS security perimeter as ending at their own credentials — every integrated vendor represents an extended attack surface. The exfiltration of data across multiple customers amplifies the blast radius significantly, making third-party access governance a critical enterprise risk concern.",[145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160],"CIS Control 3: Data Protection","CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 16: Application Software Security","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SA-9: External Information System Services","NIST SP 800-53 SI-4: Information System Monitoring","NIST CSF ID.SC-2: Suppliers and third-party partners risk assessment","NIST CSF PR.AC-4: Access permissions managed","ISO 27001 A.15.1: Information security in supplier relationships","ISO 27001 A.9.2: User access management","GDPR Article 28: Processor obligations and third-party data handling","GDPR Article 33: Notification of a personal data breach","MITRE ATT&CK T1078.004: Valid Accounts – Cloud Accounts","MITRE ATT&CK T1530: Data from Cloud Storage",{}]