Klue OAuth breach exposes Salesforce data in extortion campaign

Market intelligence platform Klue has confirmed a security breach involving its OAuth integrations, enabling the Icarus extortion group to steal Salesforce CRM data from multiple organizations. The incident, first reported on 17 June 2026, has prompted Salesforce to disable the Klue Battlecards integration as a precautionary measure while investigations are underway. Cybersecurity firms ReliaQuest and Huntress have both acknowledged their data was compromised in the attack, with Huntress confirming receipt of an extortion email from the threat actors.

What happened

The breach originated from a compromised backend system at Klue, where attackers exploited a dormant but still-active credential originally created for a prototype integration. According to Huntress, the threat actors pushed a malicious code update that harvested OAuth tokens used by Klue customers to integrate its Battlecards product with third-party platforms, including Salesforce. Once in possession of these tokens, the attackers used automated Python scripts to query Salesforce’s REST API for nearly 24 hours, exfiltrating data through endpoints such as /services/data/v59.0/sobjects and /services/data/v59.0/query.

ReliaQuest observed that the attackers initially conducted reconnaissance to map out Salesforce objects before rapidly extracting targeted data. In one case, nearly 1,000 queries were executed within a 15-minute window, suggesting a shift from stealth to speed. The stolen data includes business contacts, sales communications, price quotes, competitive intelligence reports, and account information. Huntress confirmed that no passwords, payment card details, or engineering systems were compromised.

Who is behind the attack

The campaign has been attributed to the Icarus extortion group, a relatively new threat actor that emerged in April 2026. BleepingComputer reported that Icarus has already begun sending extortion demands to affected Klue customers, with ransom notes including a Session Messenger ID for contact. The group’s data leak site features a post titled "Get Ready," hinting at further victim disclosures. While initial reports suggested possible links to the ShinyHunters group, BleepingComputer confirmed that Icarus is responsible for this campaign.

Huntress noted that the Session ID in later extortion emails matched the one listed on Icarus’s dark web leak site, reinforcing the attribution. At least one victim previously listed on the site has since been removed, potentially indicating ongoing negotiations.

Impact and response

Salesforce has temporarily disabled the Klue Battlecards integration to prevent further unauthorized access. In a statement, the company advised customers that the app would remain unavailable until the investigation concludes. Klue has also disabled integrations with HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack as part of its response.

Organizations using Klue integrations are advised to review logs for activity originating from the following IP addresses linked to the attack:

• 138.226.246.94
• 212.86.125.24
• 213.111.148.90
• 94.154.32.160

What to watch

The Icarus group’s extortion campaign is ongoing, and further victim disclosures are likely. Organizations should monitor for updates from Klue and Salesforce regarding the restoration of integrations and any additional remediation steps. The incident also highlights the growing threat of OAuth-based attacks targeting SaaS platforms, which may prompt broader industry scrutiny of third-party app security.