[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fe9CnSt8DjHiMePtftpUnKyjbDLpCPwyv1QO3bKMaGuw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":53},"e34b676e-21f7-49ba-8f03-3c7fb40d1edb","legacy-oauth-credential-exploited-in-salesforce-klue-integration-breach","b53b25cc-4b48-4453-800b-101f27ede610","Legacy OAuth Credential Exploited in Salesforce-Klue Integration Breach","The Icarus extortion group exploited a legacy credential within the Klue Battlecards third-party integration to gain unauthorized access to bulk Salesforce customer data. This incident highlights the critical risk posed by stale or unrotated credentials in third-party integrations, which often operate with broad permissions and limited oversight. Data was exfiltrated over a 24-hour window before the breach was detected and contained, demonstrating gaps in real-time monitoring of OAuth token activity. Supply chain integrations frequently inherit excessive trust and access without commensurate security controls, making them attractive targets for attackers. Organizations must treat third-party API and OAuth relationships with the same rigor as internal privileged access.","**Immediate actions:**\n- Audit and revoke all legacy or unused OAuth tokens and third-party integration credentials immediately.\n- Enforce least-privilege scopes for all OAuth integrations to limit the volume of data accessible per token.\n- Enable real-time alerting on bulk data export or anomalous API query patterns from integrated applications.\n\n**Long-term improvements:**\n- Implement a formal third-party integration lifecycle policy requiring periodic credential rotation and access reviews.\n- Maintain a complete inventory of all active OAuth integrations, their granted scopes, and data access levels.\n- Require security assessments of all third-party SaaS integrations before production onboarding.\n\n**Detection measures:**\n- Deploy user and entity behavior analytics (UEBA) to detect abnormal data access volumes from integration accounts.\n- Establish baseline thresholds for API call rates and data egress volumes per integration and alert on deviations.\n- Configure centralized logging of all OAuth token usage, including timestamps, scopes accessed, and data volumes returned.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 5: Account Management","CIS Control 12: Network Infrastructure Management","CIS Control 16: Application Software Security","NIST AC-2: Account Management","NIST AC-6: Least Privilege","NIST IA-5: Authenticator Management","NIST SI-4: System Monitoring","NIST SR-6: Supplier Assessments and Reviews","ISO 27001 A.9.4: System and Application Access Control","ISO 27001 A.15.1: Information Security in Supplier Relationships","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach","ITIL: Service Configuration Management",{},"published","2026-06-22T12:20:53.369423+00:00","2026-06-22T12:20:53.252+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fhackread.com\u002Fsalesforce-disables-klue-integration-oauth-token-data\u002F","salesforce-disables-klue-integration-after-oauth-token-theft-hits-customer-data-2b4612","Salesforce Disables Klue Integration After OAuth Token Theft Hits Customer Data",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":41,"name":42,"slug":43,"description":44,"color":45},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":47,"name":48,"slug":49,"description":50,"color":51},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[54,58,62],{"slug":55,"name":56,"problem":57},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":59,"name":60,"problem":61},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",{"slug":63,"name":64,"problem":65},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]