Klue Supply Chain Compromise and Downstream Salesforce Data Exfiltration

Executive Summary

Between June 11 and June 24, 2026, the global cybersecurity and software-as-a-service (SaaS) ecosystem experienced a severe supply chain compromise orchestrated by the financially motivated extortion group known as Icarus. The incident centered on Klue, a prominent market intelligence platform, where threat actors exploited a legacy, dormant GitHub Personal Access Token (PAT) originally issued in 2022 to gain unauthorized access to backend infrastructure. Rather than targeting Klue's proprietary data, the adversaries weaponized this access to deploy a malicious code update designed specifically to harvest active OAuth tokens used by Klue's customers to integrate with mission-critical SaaS environments like Salesforce and Gong.

The theft of these long-lived OAuth tokens allowed the attackers to completely bypass traditional perimeter defenses, including multi-factor authentication (MFA) and single sign-on (SSO), by impersonating the legitimate Klue application directly within customers' cloud environments. Operating with pre-defined privileges, the attackers utilized automated Python scripts to execute a massive extraction of Customer Relationship Management (CRM) data, including surges of nearly 1,000 automated REST API queries in a single 15-minute window. This resulted in the theft of highly contextual business intelligence affecting an estimated 700+ downstream enterprise organizations (per threat intelligence reports), with approximately 12–15 organizations publicly confirming impact as of publication — including major cybersecurity and technology vendors such as LastPass, HackerOne, Jamf, Huntress, BeyondTrust, Recorded Future, Tanium, Sprout Social, and 8x8. A secondary extortion group separately claimed possession of data belonging to 195 customers.

The incident fundamentally underscores the compounding dangers of vendor concentration risk and non-human identity mismanagement. The fallout was further complicated by poor operational security from the original threat actor, which allowed a secondary hacking group to acquire the stolen dataset and launch a parallel dual-extortion campaign against the victims.

Verification of Claims

1. Claim: The supply chain breach impacted a large number of downstream enterprise organizations. → Partially verified → Two different figures circulate and they measure different things. Reporting on confirmed victims — BleepingComputer and The Register — puts data exfiltration at close to 200 organizations, named victims including Huntress, Recorded Future, Tanium, and Jamf. Threat intelligence reports (Datadog Security Labs, Rescana, CybelAngel, Delinea) estimate 700+ organizations of potential exposure — every Klue customer whose Salesforce OAuth token was reachable through the compromised integration layer. The ~200 figure is the defensible one for confirmed impact; 700+ is the outer bound of exposure. A secondary extortion group separately claimed to possess exfiltrated data for 195 customers. Only approximately 12–15 organizations have publicly confirmed the breach as of publication (including LastPass, Huntress, Recorded Future, Sprout Social, 8x8, BeyondTrust, Tanium). The discrepancy between potential exposure and public confirmations is common in supply chain incidents where many victims choose not to disclose.

2. Claim: Initial access was achieved via a dormant legacy credential from 2022. → Verified → Multiple forensic investigations confirm the attackers authenticated using an unrevoked GitHub PAT tied to an abandoned integration pilot.

3. Claim: Threat actors compromised customer password vaults and internal core engineering infrastructure. → Unverified → Incident response investigations confirmed that the breach was strictly confined to CRM data accessible via the Klue integration layer, keeping core infrastructure secure.

4. Claim: A secondary hacking group compromised the original attackers and stole the exfiltrated dataset to launch a parallel extortion campaign. → Verified → Confirmed by researchers and customer communications; a second group posted victim lists and issued ransom demands.

5. Claim: Klue paid a ransom to the original Icarus operator to prevent data publication. → Unverified → This allegation was published by the secondary hacking group as justification for their demand and has not been independently verified.

Timeline

Attack Anatomy

• Initial Access: The threat actors weaponized a long-disused, legacy GitHub Personal Access Token generated in 2022 for an abandoned integration prototype.

• Execution: Adversaries deployed a malicious code update on the backend integration infrastructure, engineered specifically to harvest long-lived OAuth tokens.

• Privilege Escalation: Attackers acquired OAuth refresh and access tokens, completely bypassing MFA and conditional access policies.

• Lateral Movement: The attackers moved laterally from Klue's infrastructure into customers' Salesforce environments by impersonating the trusted Klue application with the stolen tokens.

• Collection: Utilizing automated Python scripts, attackers executed REST API calls targeting Salesforce endpoints to query sensitive records, circumventing data limits via the QueryMore function.

• Exfiltration: Following slow low-volume pulls, attackers initiated a massive surge of nearly 1,000 queries in 15 minutes, transferring datasets to Russian bulletproof hosting infrastructure.

• Impact: Severe data exposure occurred, causing global operational disruption of integration pipelines, followed by aggressive dual-extortion campaigns against downstream victims.

Threat Actor Profile

• Name / Alias: Icarus (Extortion alias: "mr bean"), followed by a secondary unnamed extortion group.
• Attribution Confidence: High — Multiple independent threat intelligence units conclusively attribute the primary attack to Icarus based on infrastructure and behavioral overlap.
• Motivation: Financial / Extortion.
• Sophistication Level: Moderate — Demonstrated understanding of API abuse but relied on a forgotten legacy credential and exhibited highly flawed operational security.
• Known Previous Operations: Active since April 28, 2026, listing only two prior unrelated victims.
• Nation-State Nexus: No — There is no evidence of state-sponsored espionage; it is characterized strictly as a financially motivated cybercriminal operation.
• MITRE ATT&CK Techniques:
  • T1195.002 — Supply Chain Compromise: Compromise of Software Dependencies and Development Tools
  • T1078 — Valid Accounts
  • T1528 — Steal Application Access Token
  • T1550 — Use Alternate Authentication Material
  • T1213 — Data from Information Repositories
  • T1530 — Data from Cloud Storage
  • T1071.001 — Application Layer Protocol: Web Protocols
  • T1567.002 — Exfiltration to Cloud Storage
  • T1657 — Financial Theft / Extortion
• Operational Security (OpSec): Poor to Moderate — A critical operational error by the Icarus operator allowed a secondary hacking group to compromise the Icarus infrastructure and steal the entire exfiltrated dataset.

Technical Indicators

domains:
  - "house[.]com[.]au"
  - "robinskitchen[.]com[.]au"
  - "baccarat[.]com[.]au"
  - "gofile[.]io"
ip_addresses:
  - "138.226.246[.]94"
  - "212.86.125[.]24"
  - "213.111.148[.]90"
  - "94.154.32[.]160"
file_hashes: []
urls: []
c2_infrastructure:
  - "Extortion communications originated from domains associated with subsidiaries of an Australian retailer, indicating compromised mail infrastructure."
  - "Data exfiltration dead-drop historically utilized by the actor: gofile[.]io."
  - "Leak site hosted on Autonomous System AS200593 (PROSPERO OOO, Russian Federation), designated as bulletproof hosting."
  - "Extortion negotiations conducted via Session Messenger."
  - "Automated API queries characterized by User-Agent strings: 'Python-urllib/3.12', 'Python-urllib/3.14', and '5238'."

Legal and Regulatory Response

Law Enforcement Actions

Incident response teams preserved forensic evidence, including clearnet IP addresses associated with Russian bulletproof hosting infrastructure, and shared intelligence with federal law enforcement agencies.

Government Directives

Further details are not yet publicly available.

Platform Response

Klue disabled unauthorized remote access, purged token-theft code, globally deactivated OAuth credentials, and suspended active integrations by June 13. Salesforce took platform-level intervention on June 17, 2026, officially disabling the connection for the Klue app across all tenant environments.

Criminal Proceedings

A class-action lawsuit is being organized against Klue for gross negligence regarding the legacy credential. Publicly traded victims evaluated regulatory disclosures, with 8x8, Inc. filing a Form 8-K with the SEC on June 17, 2026.

Impact Assessment

• Affected Organizations: Estimated: 195 to 200 enterprise organizations.
• Confirmed Corporate Victims: Confirmed: At least 16 organizations publicly confirmed impact, including Huntress, Jamf, LastPass, HackerOne, Recorded Future, BeyondTrust, Tanium, Sprout Social, Gong, Insurity, OneTrust, Snyk, and 8x8 Inc.
• Compromised Core Infrastructure and Password Vaults: Confirmed: 0 core products, telemetry, password vaults, or proprietary source code were accessed.
• Records Exposed: Reported: Exfiltrated datasets encompass highly sensitive CRM data, including business contact information, executive email addresses, phone numbers, historical support case logs, pricing structures, and internal sales opportunity notes.
• Operational Disruption: Confirmed: Immediate operational interruption of competitive intelligence and sales workflows occurred as integrations with Salesforce, HubSpot, and Gong were forcibly disabled.

Lessons and Defensive Recommendations

For Security Teams / SOC Analysts:

Security operations centers must recognize that OAuth-based intrusions bypass traditional authentication guardrails and appear as legitimate machine-to-machine traffic. Analysts must proactively hunt for API anomalies, scrutinizing Event Log Files (ELF) and Real-Time Event Monitoring (RTEM) logs for spikes in failed requests, aggressive use of the QueryMore command, and programmatic user-agent strings. Explicitly revoke all active sessions, OAuth access tokens, and refresh tokens associated with compromised services. Prepare the organization for highly targeted business email compromise (BEC) and phishing campaigns utilizing the stolen context.

For Developers and Architects:

Engineering teams must enforce uncompromising lifecycle management for non-human identities, programmatically expiring Personal Access Tokens (PATs), API keys, and service accounts. Implement automated secret scanning and enforce strict least-privilege scoping for all OAuth integrations.

For Platform / Cloud Providers:

Ensure that detailed API access logs, complete with endpoint URIs, client IPs, and user-agent metadata, are enabled by default and exportable to SIEMs. Implement default rate-limiting and anomaly detection on backend integrations, automatically pausing integrations exhibiting massive data extraction spikes.

For Leadership / CISO:

Demand operational transparency regarding how vendors manage credential hygiene, secret rotation, and privileged access governance within Third-Party Risk Management (TPRM) programs. Mandate strict security standards down the supply chain to address fourth-party risk. Anticipate dual-extortion scenarios in incident response playbooks, recognizing that paying cybercriminals rarely guarantees data destruction or confidentiality.

Sources

1. Rescana. "Klue Supply Chain Breach Exposes OAuth Tokens and Salesforce Data in Multi-Stage Cybersecurity Incident (June 2026)".
2. ThreatLocker. "Klue: SaaS supply chain compromise through long-lived OAuth tokens".
3. Austin Larsen. "Klue Icarus Supply Chain Extortion".
4. Snyk. "When a vendor's breach becomes yours: lessons from the Klue incident".
5. CybelAngel. "LastPass Data Breach 2026: the Klue OAuth Attack That Hit 12 Companies at Once".
6. Datadog Security Labs. "Detecting the Klue supply chain attack in Salesforce".
7. Class Action U. "Klue Data Breach Lawsuit".
8. HackerOne. "Security Advisory: HackerOne's Response to the Klue Breach".
9. Jamf. "Klue Third-Party Cybersecurity Incident".
10. BeyondTrust. "Klue Security Incident (June 2026)".
11. Huntress. "Cybercrime Breaches Klue: Salesforce Data Impacted for Many Victims, including Huntress".
12. Recorded Future. "The Klue Security Incident and Its Impact on Recorded Future".
13. RH-ISAC. "Icarus Threat Group Claims Salesforce Data Theft in Klue Supply Chain Breach".
14. Cybersecurity Dive. "Klue investigating supply chain attack that targeted Salesforce integrations".
15. SEC.gov. "eght-20260617".
16. Infosecurity Magazine. "Klue Breach Enables Hackers to Compromise Cybersecurity Firms via OAuth Tokens".
17. Strobes Security. "Top 8 Data Breaches and Exposures of June 2026".
18. The Hacker News. "Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data".
19. Sahm Capital. "BRIEF-8X8 Reports Unauthorized Access To Salesforce System Via Klue Integration".
20. Ncontracts. "July 2026 Vendor Management News".

Corrections log — 2 September 2026: Re-verified against primary reporting. No factual errors were found; the paper's ratings on the disputed claims — that customer password vaults were reached, and that a ransom was paid — correctly mark both unverified, the second noting the allegation originates from the secondary extortion group itself. One clarification added: the paper cited 700+ affected organizations without distinguishing that figure from the roughly 200 whose data exfiltration is actually confirmed in reporting. Both numbers now appear, with what each one measures.