Loading story…
Attackers breached market intelligence vendor Klue and used a compromised legacy credential tied to an old integration service to implant malicious code, harvest customer OAuth tokens, and access connected Salesforce environments through the Klue Battlecards app. Incident responders and affected companies said the attackers then used legitimate Salesforce REST API access to enumerate objects and exfiltrate CRM data over many hours, including business contacts, account records, quotes, sales communications, support case metadata, and related commercial information. Salesforce disabled the Klue app connection during the investigation and stressed the incident did not result from a vulnerability in the Salesforce platform itself, while Klue revoked credentials and tokens, disabled multiple integrations, engaged CrowdStrike, and notified law enforcement.
The campaign has been widely attributed to the Icarus extortion group, which allegedly sent ransom demands and threatened to leak stolen data, though some reporting noted tradecraft overlaps with ShinyHunters-style Salesforce OAuth abuse. Publicly disclosed victims grew from early reports involving Huntress, Recorded Future, Jamf, Tanium, Sprout Social, Gong, HackerOne, Snyk, OneTrust, and Insurity to later confirmations from LastPass, BeyondTrust, and others, with some reports putting the total affected customer count far higher. Most impacted organizations said the exposure was largely confined to CRM and business data in Salesforce or connected apps, with no evidence that core products, internal infrastructure, password vaults, payment data, or engineering systems were compromised.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
41 events from the most recent confirmed update back to the earliest known activity.
On July 13, 2026, Microsoft published research describing three Salesforce attack paths observed from mid-2025 to mid-2026, including vishing-based app consent abuse, vendor integration compromise, and guest-access abuse.
By June 26, 2026, SecurityWeek reported that roughly two dozen Klue customers had publicly confirmed compromise, including AlertMedia, Blackbaud, Camunda, Cresta, Deel, Lucanet, Link11, and Tines.
In the same June 25, 2026 customer update, Klue said Icarus reported that a second unnamed group had obtained sample data for a subset of customers and was attempting separate extortion.
TechCrunch reported on June 25, 2026 that Klue told customers it was communicating with Icarus and believed the group was taking steps to delete stolen customer data.
By June 24, 2026, SecurityWeek reported additional impacted organizations including BeyondTrust, 8x8, and Pendo, pushing the public victim count to roughly 15.
TechCrunch reported on June 23, 2026 that Klue said the compromised credential used in the attack originated from a limited 2022 pilot with a third party and had not been revoked.
On June 23, 2026, LastPass said attackers used OAuth tokens stolen from Klue to access customer data in its Salesforce environment, including contact details, support case information, and sales-related records.
Cyber Security News reported that Klue CEO Jason Smith publicly acknowledged the breach on June 22, 2026 and described it as a deliberate criminal act.
Insurity said on June 22, 2026 that its review found a limited set of active credentials exposed in CRM data and that it proactively rotated or reset them.
Snyk said on June 22, 2026 that an unauthorized party accessed business data in its Salesforce environment through Klue, including customer contact information and limited support case metadata.
SecurityWeek and Dark Reading reported that Icarus threatened to publish stolen data on June 22, 2026 unless Klue or affected customers entered negotiations.
By June 22, 2026, reporting and company disclosures had identified a growing list of affected organizations including HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, Tanium, Insurity, Sprout Social, and Gong.
Klue publicly confirmed on June 19, 2026 that attackers used a compromised legacy credential to obtain OAuth tokens for third-party platforms and access data in connected customer environments.
On June 19, 2026, Icarus claimed responsibility for the Klue-related intrusion and threatened to publish stolen customer Salesforce data unless negotiations occurred.
Gong said on June 19, 2026 that a subset of customers using the Klue integration may have had internal licensed user data such as names, titles, and email addresses accessed.
HackerOne disclosed on June 19, 2026 that CRM data was accessed and copied through Klue's OAuth integration with its Salesforce instance, while saying its products and infrastructure were unaffected.
Tanium said on June 18, 2026 that an unauthorized party accessed CRM data in its Salesforce environment through Klue, including sales account and business contact information.
Jamf disclosed on June 18, 2026 that a third party accessed data in its Salesforce instance through Klue's integration, while stating its products and core services were unaffected.
Recorded Future published its disclosure on June 18, 2026, saying the impact was limited to business data in Salesforce and that its core platform and internal systems were not compromised.
On June 18, 2026, Huntress disclosed that Klue's compromise led to theft of CRM data from its Salesforce environment, including business contacts, price quotes, sales communications, and competitive reports.
OneTrust said it identified unauthorized activity in its Salesforce environment on June 17, 2026 and linked it to the broader Klue third-party integration incident.
Recorded Future said it confirmed on June 17, 2026 that elements of its Salesforce account were affected through a compromised OAuth token tied to the Salesforce-Klue integration.
Salesforce published a security advisory on June 17, 2026 saying it had disabled the Klue Battlecards app connection after detecting unusual activity that may have exposed a subset of customer data.
Insurity said Salesforce notified it on June 16, 2026 about suspicious activity involving the Klue connected application used with its Salesforce environment.
On June 16, 2026, Huntress employees began receiving extortion emails with the subject line 'top secret email' stating that Salesforce data had been downloaded and demanding contact via Session within 48 hours.
Klue sent a general alert to customers on June 13, 2026, warning of the incident but not initially specifying which customers were impacted.
Sprout Social said unauthorized access to its Salesforce CRM through the Klue integration occurred between June 11 and June 12, 2026, exposing business contact and account-related CRM data.
On June 12, 2026, Klue disabled attacker remote access, removed the malicious code, and began revoking affected OAuth credentials and integrations to contain the breach.
Klue said it identified unauthorized activity affecting part of its integration infrastructure on June 12, 2026 after observing unusual connections tied to attacker-controlled systems.
ReliaQuest and Huntress reported that the attackers used stolen OAuth tokens and automated Python scripts to query Salesforce REST APIs, enumerate objects, and exfiltrate CRM data from multiple customer environments over extended periods.
After gaining access, the attackers inserted malicious code into Klue infrastructure to harvest customer OAuth tokens used for integrations with Salesforce and other services.
Huntress, Datadog, and others said attackers gained access to Klue's backend on June 11, 2026 using a long-unused but still-active credential tied to an old integration prototype.
Microsoft said in July 2026 that the June 2026 Klue incident involved Storm-3138, which used credentials from the compromise to access Salesforce customer instances and exfiltrate data.
Multiple sources said Icarus emerged in April 2026 and began operating a leak site and extortion infrastructure before the Klue incident became public.
After the CFGI intrusion, ShinyHunters publicized data it claimed to have obtained, including 243,000 unique email addresses plus names, phone numbers, and physical addresses.
Have I Been Pwned reported that financial consulting firm CFGI was targeted in a ShinyHunters pay-or-leak extortion campaign in March 2026.
Cato Networks reported that multiple high-profile administrators tied to the broader ShinyHunters ecosystem were arrested in France in 2025.
Cato Networks said that by 2025 the ShinyHunters identity had expanded through the Scattered LAPSUS$ Hunters federation, reflecting an organizational evolution of the brand.
Klue later said the credential abused in the 2026 breach dated back to a limited 2022 pilot and remained active after the project ended. That legacy credential became the initial access point used in the later intrusion.
Cato Networks said ShinyHunters first established its reputation in 2020 through high-volume database brokerage, providing background for later campaigns tied to the brand.
As part of its response to the Klue breach, the company said it notified law enforcement, opened an internal investigation, and engaged CrowdStrike to support forensic analysis and review security controls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
50 references tracked. Mallory keeps watching after this page renders.
cert.gov.az
Open sourcecsoonline.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcesecurityweek.com
Open sourcethehackernews.com
Open sourceklue.com
Open sourcesecurity.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ShinyHunters has claimed responsibility for breaching Cisco and stealing more than **3 million Salesforce records** along with internal corporate data, **GitHub repositories**, and contents from **AWS S3 buckets**, then posted a **"FINAL WARNING"** on its leak site threatening to publish the data after April 3. Reports said the alleged haul may include information tied to Cisco customers, employees, and personnel from U.S. and foreign government agencies, while screenshots shared by the group purportedly showed access to Cisco-linked AWS infrastructure and multiple connected cloud accounts. The intrusion was linked in reporting to three alleged access paths involving **Salesforce CRM**, **Salesforce Aura/Experience Cloud**, and AWS environments, and to activity tracked as **`UNC6040`** and **`UNC6395`**. Threat intelligence cited in the coverage said the attackers have used **vishing** to trick employees into approving malicious Salesforce OAuth applications, then abused stolen tokens to bypass MFA and move deeper into cloud environments; recommended defenses included auditing connected OAuth apps, revoking suspicious tokens, tightening API access controls, and monitoring for unauthorized Salesforce Data Loader activity. Cisco had not publicly addressed the March 2026 extortion claim at the time of reporting.
Jun 29, 2026
A significant wave of OAuth-related breaches has recently impacted the Salesforce ecosystem, resulting in the exposure of sensitive data from over 700 organizations and affecting nearly 1.5 billion records. The breaches were not due to a direct compromise of Salesforce itself, but rather stemmed from attackers exploiting weaknesses in third-party OAuth integrations connected to Salesforce environments. At the recent Dreamforce conference, Salesforce emphasized security as a shared responsibility and introduced new AI-driven security and compliance agents, but notably did not address the recent OAuth breach incidents that have led to more than 70 lawsuits. Security experts highlighted this omission, noting that the lessons from these breaches are critical for the future of interconnected, AI-driven business platforms. According to Google Threat Intelligence Group, the attackers systematically exported large volumes of data from numerous corporate Salesforce instances by abusing OAuth tokens. These tokens, which are designed to allow secure, delegated access to cloud applications, were leveraged by threat actors to gain persistent, high-privilege access to customer data. Proofpoint researchers have further warned that attackers are increasingly abusing both external and internal OAuth-based applications to maintain access to cloud environments, even after password resets or the enforcement of multifactor authentication. Internal OAuth applications, which are registered within an organization’s own cloud tenant and typically trusted, can be particularly difficult to detect when compromised. Attackers have developed automated toolkits to register malicious OAuth applications with pre-configured permissions, using compromised admin accounts to escalate privileges and maintain persistence. The breaches underscore the risks inherent in SaaS supply chains, where third-party integrations can become a vector for large-scale data exfiltration. Security professionals stress the importance of monitoring OAuth app permissions, regularly auditing third-party integrations, and educating users about the risks of granting excessive access. The incident has prompted calls for greater transparency and proactive security measures from both SaaS providers and their customers. The scale of the breach and the sophistication of the attack methods highlight the evolving threat landscape facing cloud-based business platforms. Organizations are urged to review their OAuth security posture and implement robust controls to mitigate similar risks in the future. The incident serves as a stark reminder that even trusted cloud environments can be compromised through indirect attack vectors, necessitating a holistic approach to cloud security.
Jun 29, 2026
A series of extortion attacks have targeted organizations using Salesforce, resulting in the leakage of millions of records. Attackers have exploited vulnerabilities or misconfigurations in Salesforce environments to gain unauthorized access to sensitive customer and business data. Once inside, the threat actors exfiltrated large volumes of information, which they then used as leverage in extortion attempts against the affected companies. The attackers threatened to publicly release or sell the stolen data unless their demands were met, putting significant pressure on the victim organizations. Security experts have highlighted that these incidents demonstrate the growing risk of supply chain and third-party platform attacks, as Salesforce is widely used across industries for customer relationship management. The attacks have raised concerns about the adequacy of security controls and monitoring within cloud-based SaaS platforms, especially when organizations rely heavily on default configurations. In response, security professionals have urged companies to review their Salesforce security settings, implement robust access controls, and monitor for unusual activity. The incidents have also prompted calls for better incident response planning, as organizations must be prepared to act quickly in the event of a breach involving critical business platforms. The extortion group responsible for these attacks has demonstrated technical sophistication, leveraging both technical exploits and social engineering tactics to maximize their impact. The exposure of millions of records has potential regulatory and reputational consequences for the affected organizations, particularly in jurisdictions with strict data protection laws. Security podcasts and news outlets have discussed the technical details of the attacks, the methods used by the extortionists, and the broader implications for cloud security. Experts have also noted that these attacks may inspire copycat incidents targeting other SaaS providers. The events underscore the importance of regular security assessments and employee training to defend against evolving threats. Organizations are advised to stay informed about emerging attack techniques and to collaborate with their SaaS vendors to ensure comprehensive security coverage. The Salesforce extortion attacks serve as a stark reminder of the risks associated with cloud service dependencies and the need for proactive cybersecurity measures.
Jun 29, 2026