KLUE OAUTH BREACH FUELS SALESFORCE DATA THEFT

The OAuth vulnerability in Klue's systems provided attackers unauthorized access to connected Salesforce instances across affected clients. Icarus operators leveraged this access to exfiltrate sensitive customer relationship data, subsequently using the stolen information as leverage in extortion demands. The attack highlights growing risks associated with OAuth integrations between third-party platforms and enterprise applications. Market intelligence tools like Klue often maintain broad access permissions to customer data systems, creating high-value targets for threat actors. Klue has not yet released detailed technical information about the breach's scope or timeline. Security researchers tracking the Icarus group indicate the campaign has targeted multiple SaaS platforms over recent months, suggesting a pattern of exploiting integration vulnerabilities. Organizations using Klue are advised to review OAuth permissions, audit recent Salesforce access logs, and monitor for extortion communications from the threat actors.