KLUE OAUTH BREACH FUELS SALESFORCE DATA THEFT

SECURITY DESK■ 1 MIN READ

THU, JUN 18, 2026

■ AI-SUMMARIZED FROM 2 SOURCES ▸ TIMELINE

Market intelligence platform Klue fell victim to an OAuth breach that enabled threat actors dubbed 'Icarus' to steal Salesforce CRM data from multiple organizations. The breach is part of an ongoing extortion campaign targeting enterprise customers.

The OAuth vulnerability in Klue's systems provided attackers unauthorized access to connected Salesforce instances across affected clients. Icarus operators leveraged this access to exfiltrate sensitive customer relationship data, subsequently using the stolen information as leverage in extortion demands. The attack highlights growing risks associated with OAuth integrations between third-party platforms and enterprise applications. Market intelligence tools like Klue often maintain broad access permissions to customer data systems, creating high-value targets for threat actors. Klue has not yet released detailed technical information about the breach's scope or timeline. Security researchers tracking the Icarus group indicate the campaign has targeted multiple SaaS platforms over recent months, suggesting a pattern of exploiting integration vulnerabilities. Organizations using Klue are advised to review OAuth permissions, audit recent Salesforce access logs, and monitor for extortion communications from the threat actors.

■ SOURCES

► Bleeping Computer ► Bleeping Computer

■ SUMMARY WRITTEN BY AI FROM THE LINKS ABOVE

■ MORE FROM THE SECURITY DESK

P669TWO MAJOR ATTACK CHAINS HIT H1 2026

Gen's latest threat report details two distinct attack campaigns exploiting compromised email accounts and clipboard manipulation to steal from businesses and cryptocurrency users.

JUST NOW— AI Desk

P667RESEARCHERS EXPOSE COMPANIES SENDING SECRETS TO FAKE 'NO REPLY' ADDRESSES

Two security researchers purchased commonly-used generic email domains and discovered hundreds of companies automatically sending sensitive corporate data to their listening services. The experiment reveals a widespread failure in email configuration practices across organizations.

JUST NOW— AI Desk

P661HEDGE FUNDS TARGETED IN BLACKFILE-LINKED ATTACK WAVE

Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.

2H AGO— Security Desk

P659CLICKFIX ATTACKS DEPLOY MACOS MALWARE FOR CRYPTO THEFT

A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.

4H AGO— Industry Desk

◄ BACK TO NEWS

KLUE OAUTH BREACH FUELS SALESFORCE DATA THEFT

■ MORE FROM THE SECURITY DESK

■ SUBSCRIBE TO THE DAILY BRIEF