Icarus Threat Actor Exploits Klue OAuth Breach to Exfiltrate Salesforce CRM Data Across Multiple Organizations
June 30th, 2026
High
%20Enables%20Root-Level%20Backdoor%20Acces.jpg)
Our Cyber Threat Intelligence Unit is monitoring an active supply chain campaign in which the threat actors tracked as Icarus compromised the backend infrastructure of Klue, a market intelligence platform, to steal OAuth tokens belonging to Klue's customers and use them to exfiltrate Salesforce CRM data across multiple organizations. The campaign was detected in June 2026 and combines vendor-level token theft with automated REST API queries against downstream customer Salesforce environments. Salesforce has disabled the Klue Battlecards integration platform-wide while the incident is under investigation. Extortion demands have been issued to at least several affected organizations, and Icarus has listed Klue on its data leak site. The full victim count and scope of exfiltrated records remain under active investigation.
Technical Details
Threat Type: Supply Chain Attack / OAuth Token Theft / CRM Data Exfiltration / Extortion
Severity: High
Threat Actors: Icarus
Affected Platform: Klue Battlecards integration with Salesforce (and secondary integrations with HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack)
Exploit Status: Actively exploited in the wild
Attack Chain Overview:
Initial Access: The threat actor exploited a dormant but still-active Klue service account credential that had been originally created for a prototype third-party integration that was subsequently abandoned. This credential provided initial entry into Klue's backend infrastructure.
Persistence / Token Harvesting: Following initial access, the attacker deployed malicious code within Klue’s integration infrastructure to harvest OAuth tokens used by Klue customers to connect Battlecards with third-party platforms, including Salesforce. Klue detected unusual network activity in the compromised environment on June 12, 2026, noting connections to IP addresses used by the threat actor to remotely access Klue’s backend servers, which led to the discovery of the unauthorized activity.
Reconnaissance: Using the harvested OAuth tokens, the attacker authenticated to the victim's Salesforce environments via the Klue integration service account.Reconnaissance was conducted via GET requests to the /services/data/v59.0/sobjects endpoint to enumerate each organization's Salesforce object catalog.
Exfiltration: The attacker executed automated Python scripts (identifiable by Python-urllib/3.12 and Python-urllib/3.14 user-agent strings, and in some cases a user-agent value of 5238 or blank) against the Salesforce REST API query endpoint (/services/data/v59.0/query), paginating through results using the QueryMore cursor. In observed environments, the attacker transitioned from lower-volume API activity to rapid, automated data extraction, issuing hundreds of Salesforce REST API queries in a short period to retrieve large volumes of data. Exfiltrated data types include business contacts, price quotes, sales communications, subscription details, opportunity notes, and competitive intelligence reports.
Post-Exploitation / Extortion: Following data theft, extortion emails were sent to affected organizations using the alias “mr bean,” directing recipients to communicate through Session Messenger. Icarus publicly claimed responsibility for the campaign on its leak site and has historically staged exfiltrated data through the file-sharing service gofile[.]io. The group attempted to pressure affected organizations into negotiations. Prior to the public disclosures, the group’s leak site included a message dated June 12, 2026, stating, “get ready; big corps getting listed. be ready.”
Impact
CRM Data Exfiltration: Confirmed theft of Salesforce CRM records, including business contact information, account details, product pricing, sales communications, and competitive market intelligence across multiple organizations.
Multi-Organization Scope: The vendor-level compromise of Klue's OAuth infrastructure allowed the attacker to pivot across multiple downstream customer environments from a single point of entry, amplifying the blast radius significantly beyond the initial victim.
Supply Chain Risk Amplification: Trusted third-party integrations holding persistent, broad OAuth access to core business platforms represent a high-value, low-scrutiny attack surface. The Klue compromise demonstrates that a single vendor-side intrusion can cascade into data theft across its entire customer base.
Extortion and Reputational Risk: Affected organizations face active extortion pressure. Icarus has demonstrated a willingness to publish exfiltrated data on its leak site if demands are not met.
Residual Access Risk: If OAuth refresh tokens were not immediately rotated following the incident, persistent attacker access to victim Salesforce environments cannot be ruled out, as refresh tokens survive session termination unless explicitly revoked.
Secondary Platform Exposure: Klue's integrations extended beyond Salesforce to include HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack, meaning organizations with multiple active integrations may have additional data exposure in those platforms pending log review.
Detection Method
Security teams should review API and access logs across all platforms that were connected to Klue integrations. Key detection indicators include:
Query Salesforce event logs for REST API calls originating from the following user-agent strings:
Python-urllib/3.12, Python-urllib/3.14, a numeric value of 5238, or a blank user-agent value.
Legitimate integration traffic will not typically carry these identifiers.
Identify anomalous query volume against the /services/data/v59.0/query endpoint, particularly sustained high-rate query bursts (near 1,000 queries within any 15-minute window) or extended extraction windows from a single service account.
Review Salesforce API logs for GET requests to /services/data/v59.0/sobjects, which may indicate an enumeration phase preceding bulk exfiltration.
Correlate all Salesforce API access against the four known attacker IP addresses listed in Section 5.0. Any matching access events should be treated as confirmed indicators of compromise.
Review email inboxes, including spam folders, for extortion messages referencing the Klue incident, containing the phrase “Your Salesforce data has been downloaded,” or providing a Session Messenger ID for contact. These messages may have been routed to spam by mail filters.
Review Gong and other integrated platform logs for access events originating from the same known-malicious IP addresses during the June 11–13, 2026 window.
SIEM rules should be configured to alert on Salesforce REST API query volume spikes from integration service accounts, and on OAuth token refresh events from unfamiliar infrastructure.
Indicators of Compromise
Type | Indicator | Description |
IPv4 Address | 138[.]226[.]246[.]94 | Attacker infrastructure; also associated with spam campaigns from March 2026 |
IPv4 Address | 212[.]86[.]125[.]24 | Attacker infrastructure |
IPv4 Address | 213[.]111[.]148[.]90 | Attacker infrastructure |
IPv4 Address | 94[.]154[.]32[.]160 | Attacker infrastructure |
Domain | gofile[.]io | File-sharing service used by Icarus to stage exfiltrated data |
Email Domain | house[.]com[.]au | Compromised Global Retail Brands subsidiary domain; used to deliver extortion emails bypassing spam filters |
Email Domain | robinskitchen[.]com[.]au | Compromised Global Retail Brands subsidiary domain; used to deliver extortion emails bypassing spam filters |
Email Domain | baccarat[.]com[.]au | Compromised Global Retail Brands subsidiary domain; used to deliver extortion emails bypassing spam filters |
Recommendations
Revoke and rotate all Klue-related OAuth tokens immediately. Reset service-account passwords, revoke OAuth grants and refresh tokens, and reissue client secrets for the Klue integration. Resetting the password alone is insufficient — the refresh token must be explicitly revoked to terminate persistent attacker access.
Terminate all active sessions tied to the Klue service account across Salesforce and any other integrated platform. Revoking the service integration may not invalidate existing sessions; session revocation must be performed separately.
Conduct a full log review across all Salesforce-connected platforms. Prioritize Salesforce event logs, then Gong, and any other platforms connected to Klue via OAuth. Use the IOCs in Section 5.0 as your primary search criteria. If logs are not immediately accessible, engage vendors directly and invoke active security incident response procedures.
Enforce IP allowlisting on all Salesforce-connected integration service accounts and connected apps. Restrict API access to known, approved source IP ranges. Apply equivalent controls to SIEM and SOAR API endpoints to prevent secondary enumeration of detection tooling.
Review inboxes and spam folders for extortion communications. Retain any identified messages for forensic purposes rather than deleting them. Notify relevant stakeholders and legal counsel if extortion contact is confirmed.
Conduct a full inventory of third-party SaaS integrations holding OAuth access to core platforms. Validate that all active integrations are still required, that their access scopes conform to least privilege, and that no dormant or prototype credentials remain active.
Apply the same monitoring rigor to integration service accounts as to privileged human accounts. Non-human identities with persistent OAuth access to sensitive platforms represent a high-value, under-monitored attack surface and should be included in identity governance and behavioral monitoring programs.
Engage your cyber insurance provider if you have confirmed or suspected data exposure, to initiate investigation, remediation, and after-action support in accordance with your policy terms.
Conclusion
The Klue-Icarus supply chain campaign shows how a single vendor compromise can trigger a cascading, multi-organization data breach by abusing trusted OAuth integrations. Because the attacker operated entirely within legitimate credentials and API boundaries, the intrusion required no malware and generated no traditional endpoint alerts; detection relied entirely on API-layer behavioral anomalies. The immediate priority for affected organizations is to revoke OAuth refresh tokens and conduct thorough log reviews across all Klue-connected platforms. More broadly, this incident reinforces the need to inventory, scope to least privilege, and monitor third-party SaaS integrations that maintain persistent access to CRM and business intelligence systems with the same rigor applied to privileged user accounts. The Icarus group remains active and has signaled intent to continue targeting large organizations; follow-on extortion activity or further victim disclosures are assessed as likely.