June 2026 supply-chain emergency: Competitive-intelligence platform Klue was breached starting June 11, enabling the Icarus extortion group to harvest OAuth tokens and exfiltrate Salesforce CRM data from multiple customers—including cybersecurity vendors Huntress, Recorded Future, Tanium, and Jamf.
Attack chain
- Attacker abused a long-disused Klue integration credential to access backend systems.
- Malicious code update collected OAuth tokens Klue uses for Salesforce, HubSpot, Gong, Slack, Zoom, and other SaaS integrations.
- Stolen tokens were used to query customer CRM instances directly—bypassing Klue’s product UI.
- Icarus emailed victims June 16 with 48-hour extortion deadlines; samples appeared on gofile.io dead drops.
Huntress confirmed exfiltration of business contacts, pricing quotes, and sales communications—not Huntress agent telemetry, customer passwords, or payment data. Salesforce disabled the Klue Battlecards integration.
Remediation
- Revoke all active Salesforce/HubSpot/Gong sessions—not just Klue app tokens.
- Review Salesforce API logs for Python urllib user-agents and suspicious query patterns cited by Huntress.
- Block IOC IPs: 138.226.246.94, 212.86.125.24, 213.111.148.90, 94.154.32.160.
- Review inboxes for “top secret email” extortion messages from compromised Australian retail mail infrastructure.
Canonical record: Klue 2026 on BreachHistory.
Sources: Huntress, Salesforce Ben