Klue Supply-Chain Cyber Attack

Classification	TLP:White
Prepared By	DTG Threat Management Practice
Date Issued	June 30, 2026
Security Rating	Critical

Findings Overview

In June 2026, Klue, a Vancouver-based competitive intelligence software-as-a-service (SaaS) platform, became the entry point for a supply-chain attack that exposed Salesforce customer relationship management (CRM) environments at an estimated 195 or more customer organizations, including several major cybersecurity vendors. The financially motivated extortion group Icarus claimed responsibility. Operators reportedly used an abandoned legacy credential that remained active after a 2022 prototype project to access Klue's integration infrastructure.

The compromise followed a familiar OAuth supply-chain pattern. Attackers inserted token-harvesting code into Klue's integration pipeline, collected customer OAuth tokens, and used those bearer tokens to automate bulk extraction from downstream Salesforce CRM instances through REST API queries. Exposed data included business contacts, pricing information, opportunity notes, contracts, sales communications, and competitive intelligence. This information could support targeted phishing, business email compromise (BEC), and competitive espionage.

The incident escalated when Icarus was reportedly compromised by an unnamed second threat actor. That actor claimed access to data from 195 Klue customers and launched a separate extortion campaign, turning a single vendor compromise into a broader, multi-party exposure.

Attribute	Detail
Victim Platform	Klue, a competitive intelligence SaaS platform based in Vancouver, Canada.
Attack Dates	June 11-12, 2026.
Threat Actor	Icarus, an extortion group active since approximately April 2026.
Attack Vector	Dormant legacy API credential, OAuth token harvesting, and Salesforce REST API exfiltration.
Estimated Victims	195 or more Klue customers, including 13 or more publicly confirmed victims.
Data Types Exposed	CRM contacts, pricing, contracts, opportunity notes, and sales communications.
Incident Response	CrowdStrike engaged; Klue revoked all OAuth tokens on June 13, according to RH-ISAC.
Extortion Channel	Session Messenger alias "mr bean" and Tor-based data leak site, according to ZeroFox.
Current Status	Active, with second-tier extortion campaign ongoing as of June 29, 2026.

Executive Assessment

This is not an isolated event. It is the third known SaaS supply-chain attack in recent months involving compromised third-party OAuth integrations used to harvest Salesforce customer data. The pattern is accelerating. Organizations with third-party SaaS integrations connected to CRM, productivity, or revenue platforms should treat this brief as a near-term priority.

Attack Timeline and Scope

Date	Event
2022	Klue creates a legacy service account credential for a third-party integration prototype. The project is later abandoned, but the credential is never decommissioned.
Pre-June 11	Icarus acquires the credential through an unknown method, potentially involving a CI/CD pipeline, developer code leak, or device compromise.
June 11	Datadog's Cloud SIEM detects the earliest anomalous activity in Klue's integration infrastructure.
June 11	Malicious code is pushed to Klue's integration pipeline. The token-harvesting backdoor activates and begins collecting OAuth tokens from customer integrations.
June 11-12	Automated Python scripts issue Salesforce Global Describe queries, then execute Salesforce Object Query Language (SOQL) bulk exports. One victim observed roughly 1,000 API queries in 15 minutes; several cases showed extraction windows of six or more hours.
June 12	Klue detects unauthorized external connections and anomalous backend commands.
June 13	Klue revokes all customer OAuth tokens, disables all third-party integrations, and sends an initial customer alert.
June 16	Affected organizations receive extortion emails with the subject "top secret email" and a 48-hour deadline to contact "mr bean" through Session Messenger.
June 17	ReliaQuest publishes the first public threat spotlight; Salesforce officially disables the Klue Battlecards app integration.
June 19	Icarus publishes Klue on its Tor-based data leak site; the extortion deadline is communicated as June 22.
June 22	Klue publicly confirms the breach; CrowdStrike is engaged for incident response; multiple victim organizations disclose impact.
June 24-25	Klue tells customers Icarus agreed to delete stolen data; a second unnamed threat actor simultaneously claims data from 195 Klue customers and launches a separate extortion campaign.
June 29	Additional victims continue to surface; Icarus's data leak site is intermittently offline; second-tier extortion remains active.

Scope of Impact

At least 13 organizations have publicly confirmed impact, while a second threat actor claims as many as 195 victims. Confirmed victims include cybersecurity vendors, identity providers, and enterprise SaaS companies that hold sensitive security and business data for their own downstream customers.

Confirmed Victim	Sector	Data Exposed
Huntress	Cybersecurity (MDR)	Business contacts, pricing quotes, subscription details, sales communications, opportunity notes
Recorded Future	Threat Intelligence	Client contact names, email addresses, potential contract data
Tanium	Endpoint Security	Business contacts (names, addresses, job titles, emails, social media handles)
HackerOne	Bug Bounty / AppSec	CRM business contact data
Jamf	Apple MDM / IT Mgmt	CRM-related data; downstream customer phishing risk
OneTrust	Data Privacy / GRC	CRM business contact data
Snyk	Developer Security	CRM business contact data
LastPass	Identity / Password Mgmt	Names, emails, phone numbers, physical addresses, support case data, sales-related info
Sprout Social	Social Media Analytics	CRM business contact data
Gong	Revenue Intelligence	CRM data; Gong also disabled its own Klue integration
Insurity	Insurance Technology	CRM business contact data
Abnormal Security	Email Security	CRM business contact data
Netskope	SASE / Cloud Security	CRM business contact data
AlertMedia, Blackbaud, Camunda, Cresta, Deel, Lucanet, Link11, Tines	Various	CRM data confirmed via Klue customer disclosures

What Happened

The Root Cause: A Forgotten Credential

The kill chain began with a non-human identity (NHI) lifecycle failure. A service account API credential created in 2022 for a third-party integration prototype was never revoked after the project ended. The credential remained dormant for about four years: unmonitored, unrotated, and over-privileged. After the attacker obtained it, the credential provided authenticated access to Klue's integration backend.

This was not a novel vulnerability class. It was a governance failure. Many organizations apply strict controls to human privileged accounts but give less attention to service accounts, API tokens, and OAuth credentials. Icarus exploited that gap.

Stage 1: Credential Exploitation and Backdoor Injection

After obtaining the legacy credential, the attacker authenticated to Klue's integration infrastructure and inserted token-harvesting code into the integration pipeline. The code intercepted OAuth tokens as Klue's platform used them to communicate with connected third-party services for customers. Because OAuth tokens are bearer tokens, the attacker did not need usernames, passwords, or multi-factor authentication (MFA) to impersonate legitimate integrations.

The affected Klue Battlecards integration connected to Salesforce, HubSpot, SharePoint, Zoom, Gong, Slack, and other platforms. Each harvested token gave the attacker authenticated access to the corresponding platform through a trusted, approved integration.

Stage 2: Reconnaissance via Salesforce Global Describe

The first documented post-access action against customer Salesforce environments was a Global Describe query (GET /services/data/v59.0/sobjects). This metadata call returns a full inventory of accessible Salesforce objects, properties, and limits. For a production Klue Battlecards integration, this behavior was anomalous because the integration had no legitimate reason to query the full CRM schema.

This step mapped the Salesforce data repositories available to the attacker before extraction began.

Stage 3: Automated Bulk Exfiltration

Using the schema map, attackers ran automated Python scripts through the Salesforce REST API to issue bulk SOQL queries against discovered objects and paginate through full record sets:

# Reconnaissance GET

/services/data/v59.0/sobjects

# Bulk query execution POST

/services/data/v59.0/query (SOQL: Account, Contact, Opportunity, Lead, Contract, Case, Task)

# Pagination GET

/query/{QueryLocator} (QueryMore: extract full datasets batch by batch)

Obsidian Security documented approximately 13.9 million records exfiltrated from one victim organization. That victim's data spanned more than 100 standard and custom Salesforce objects, including support cases, file attachments, contracts, Configure, Price, Quote (CPQ) records, and quotes. In several documented cases, extraction sessions ran for six or more consecutive hours.

Stage 4: Extortion and Second-Tier Threat

Beginning June 16, affected organizations received extortion emails titled "top secret email," demanding contact through Session Messenger within 48 hours and threatening publication on Icarus's Tor-based leak site, which went live June 19.

By June 24-25, Klue reported that Icarus had agreed to delete the stolen data. At the same time, a second unknown actor claimed possession of sample data from 195 Klue customers and launched a separate extortion campaign. The competing claims weaken any assumption that negotiating with the first attacker eliminates downstream risk.

Indicators of Compromise

Network IOCs: Confirmed Malicious IP Addresses

IP Address	Location / Provider	Role in Attack
138.226.246[.]94	Netherlands (VPS)	Primary reconnaissance and exfiltration source; observed first across multiple victims
212.86.125[.]24	France (VPS)	Secondary exfiltration IP; mid-session IP rotation observed
213.111.148[.]90	Ukraine (VPS)	Confirmed IOC corroborated by ReliaQuest and Obsidian
94.154.32[.]160	VPS Infrastructure	Observed approximately 3.5 hours after initial activity during reconnaissance pivot.

Block all four IP addresses at perimeter and cloud egress controls immediately. Review SIEM and Salesforce event logs from June 11, 2026 onward.

Behavioral and Application IOCs

IOC Type	Value / Pattern	Significance
HTTP User Agent	python-urllib/3.12, python-urllib/3.14	Malicious automation scripts; deviates from legitimate python-httpx baseline used by Klue.
Salesforce API Version	/services/data/v59.0/	Downgraded from legitimate v64.0; strong signal of unauthorized non-Klue actor.
Salesforce Endpoint	GET /services/data/v59.0/sobjects	Global Describe query for reconnaissance of the full CRM schema.
Query Volume	~1,000 REST API queries in 15 minutes	Automated bulk extraction pattern; far exceeds normal integration traffic.
Pagination Pattern	GET /query/{QueryLocator} at scale	QueryMore bulk pagination for automated CRM data export.
Extortion Email Subject	"top secret email"	Extortion notification; preserve for forensics if found.
Extortion Messenger	Session Messenger app, alias "mr bean"	Threat actor contact channel
Connected App Name	Klue Battlecards	Target integration; disable and revoke if present in Salesforce Connected Apps.
Source IP Geolocation Pattern	Netherlands, France, Ukraine	Non-Google Cloud origins; legitimate Klue infrastructure originates from Google Cloud / Google Inc. IP ranges.

Detection Queries (Salesforce Event Monitoring / Security Information and Event Management)

# Splunk / SIEM: Hunt for malicious user agents in Salesforce API logs

index=salesforce_events UserAgent IN ("python-urllib/3.12", "python-urllib/3.14")

# Detect Klue Battlecards connected app activity

index=salesforce_events ConnectedAppName="Klue Battlecards"

# Flag API version downgrade

index=salesforce_events URI="/services/data/v59.0/*"

# High-volume API query spikes

index=salesforce_events EventType=ApiTotalUsage | stats count by UserName, SourceIp | where count > 500

Tactics, Techniques, and Procedures (TTPs)

MITRE ATT&CK Framework Mapping

Tactic	Technique	ID	Observed Behavior
Initial Access	Supply-Chain Compromise	T1195	Exploited an abandoned legacy service account credential that had not been decommissioned.
Initial Access	Valid Accounts: Cloud Accounts	T1078.004	Authenticated using the stolen legacy credential to Klue's cloud integration infrastructure.
Execution	Command & Scripting: Python	T1059.006	Python scripts with python-urllib user agents executed automated SOQL queries and data extraction routines.
Persistence	Modify System Image / Code Injection	T1601	Injected token-harvesting code into Klue's SaaS integration pipeline to collect OAuth tokens.
Credential Access	Steal Application Access Token	T1528	Harvested customer OAuth bearer tokens from Klue's integration layer; no MFA bypass was required.
Discovery	Cloud Service Discovery	T1526	Issued Salesforce Global Describe API calls to enumerate all accessible CRM objects and metadata before extraction.
Collection	Data from Cloud Storage	T1530	SOQL queries targeting Account, Contact, Opportunity, Lead, Contract, Case, Task, CPQ, and custom objects.
Exfiltration	Automated Exfiltration	T1020	Sustained, automated extraction using QueryMore pagination over windows of six or more hours.
Exfiltration	Exfiltration Over Web Service	T1567	Data exfiltrated through Salesforce HTTPS REST API endpoints, blending with legitimate integration traffic.
Impact	Financial Extortion	T1657	Multi-tier extortion through a Tor data leak site and Session Messenger; deletion promises from the original attacker were undermined by a secondary actor.

Adversarial Behavioral Hallmarks

Stealth over speed, initially: The attacker used bearer token access to blend into legitimate SaaS traffic. There was no malware, traditional lateral movement, or endpoint artifact. Detection depended on API-layer behavior analysis, not endpoint or network signatures.

Opportunistic victim selection: Victims were not individually targeted; they were exposed through Klue's customer base. Any organization using the Klue Battlecards integration was in scope.

Non-uniform activity windows: Unlike prior UNC6395/ShinyHunters Salesforce campaigns, where activity was tightly clustered, Icarus varied its timing across victims, making cross-victim correlation harder.

Operational security degradation under pressure: After public exposure, Icarus showed notable operational security (OPSEC) failures. Its infrastructure was compromised, its data leak site went intermittently offline, and its extortion communications became increasingly erratic.

Second-tier extortion escalation: The second threat actor's access to Icarus's stolen data shows that extortion groups are also targets, creating compounding victim exposure that negotiation alone cannot resolve.

Risk Implications

Immediate Threat Surface

Targeted spear-phishing and vishing: Attackers now have names, job titles, email addresses, phone numbers, and contextual sales intelligence about relationships, deal stages, and pricing. That information can support highly personalized impersonation attacks against employees, customers, and vendors of affected organizations.

Business Email Compromise (BEC): Opportunity notes, contract values, and pricing quotes provide the context needed to impersonate executives, finance staff, or vendors in wire-transfer and invoice fraud schemes.

Social engineering campaigns: Full contact profiles and organizational context allow Icarus or downstream buyers to craft pretexts that closely resemble legitimate business communications, such as renewal notices, IT help desk outreach, or vendor messages.

Competitive intelligence exposure: Klue centralizes competitive intelligence, battlecards, positioning playbooks, and pricing strategies. For organizations using Klue as intended, the attacker may have exfiltrated strategic intelligence as well as CRM data.

Structural and Strategic Risk

Double extortion risk: Organizations that reached data deletion agreements with Icarus still face claims from a second independent actor holding the same data. No payment to Icarus can recall data already transferred to a third party, and there is no reliable mechanism to verify deletion.

Third-party cascade risk: Organizations that do not use Klue may still be exposed if their contact records reside in the Salesforce CRM environment of a confirmed victim. This creates third-party exposure without a direct vendor relationship or notification path.

Regulatory and legal exposure: Depending on jurisdiction and data classification, affected organizations may face breach notification obligations under the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), state privacy laws, and sector-specific regulations such as the Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley Act (GLBA), and Federal Financial Institutions Examination Council (FFIEC) guidance. Delayed notification can increase regulatory and litigation risk.

Reputational and customer trust impact: Several confirmed victims are cybersecurity vendors whose services depend on trust. Public disclosure that CRM data and customer records were exfiltrated can affect client confidence and sales cycles.

Pattern risk, not a one-off: This is the third known SaaS supply-chain attack involving Salesforce integrations in the 2025-2026 timeframe, following campaigns associated with ShinyHunters/UNC6395 through Salesloft Drift and Gainsight. Threat actors have shown that SaaS OAuth integrations are a repeatable and scalable attack surface.

Executive Action Priorities

Immediate Actions

Determine exposure: Direct IT and security teams to assess whether the organization currently uses Klue, used Klue historically, or has active Salesforce OAuth integrations. Review Salesforce Connected Apps and OAuth authorization logs.

Revoke all Klue-related OAuth tokens: Revoke active and refresh tokens tied to Klue or Klue-connected applications. Password resets are insufficient; the OAuth token chain must be explicitly revoked in Salesforce.

Block confirmed malicious IP addresses: Direct firewall and SIEM teams to block 138.226.246[.]94, 212.86.125[.]24, 213.111.148[.]90, and 94.154.32[.]160, then search logs for traffic to or from these addresses from June 11 onward.

Hunt Salesforce API logs: Query Salesforce Event Monitoring for python-urllib user agents, API v59.0 calls, Global Describe queries, and anomalous query volume from June 11-13. Engage DTG for digital forensics and incident response (DFIR) support if evidence of compromise is found.

Rotate integration credentials: Rotate service account passwords, client secrets, API keys, and connected app secrets associated with Klue and similarly scoped third-party integrations.

Brief leadership: Inform the Chief Information Security Officer (CISO), Chief Technology Officer (CTO), General Counsel, and Communications teams of potential exposure. Prepare holding statements and review breach notification obligations.

Short-Term Actions

Conduct a comprehensive SaaS OAuth integration audit: Inventory OAuth-connected applications across Salesforce, HubSpot, SharePoint, Slack, Gong, and other platforms. Remove inactive, unrecognized, or over-scoped integrations.

Enforce least privilege on integration grants: Re-scope remaining third-party OAuth authorizations to the minimum permissions required. Remove grants that include Global Describe access, full CRM export, or administrative scope unless explicitly justified.

Decommission legacy credentials: Audit service accounts and API tokens. Revoke any credential tied to an inactive prototype, pilot, or discontinued vendor.

Brief client-facing and sales teams: Staff whose data was exposed should receive targeted briefings on heightened BEC, phishing, and social engineering risk. Require out-of-band verbal verification for financial transactions.

Notify the cyber insurance carrier: If data exposure is confirmed or suspected, notify the cyber insurance carrier promptly to preserve coverage eligibility and access breach coach or IR resources.

Validate SIEM and extended detection and response (XDR) SaaS coverage: Confirm that Salesforce Event Monitoring logs are ingested and parsed in the SIEM. Add detection rules for OAuth anomalies, unexpected API query volume, and connected app behavior deviations.

Strategic Actions

Implement non-human identity (NHI) governance: Establish a program for service accounts, API tokens, and OAuth credentials that matches the rigor applied to privileged human accounts: periodic rotation, scope review, ownership assignment, and mandatory revocation when projects end.

Evaluate SaaS Security Posture Management (SSPM): Assess SaaS Security Posture Management platforms such as Obsidian Security, Valence Security, and AppOmni for continuous monitoring of third-party OAuth integrations, behavioral baselining, and anomaly detection.

Conduct a SaaS supply-chain tabletop exercise: Simulate OAuth token exfiltration to test detection, escalation, and response. DTG Threat Management can design and facilitate an exercise matched to the SaaS environment.

Update vendor risk management processes: Revise onboarding and annual review questionnaires to address legacy credential management, OAuth token lifecycle policy, integration monitoring, and incident response commitments.

Engage DTG for a targeted compromise assessment: If a Klue-affected vendor is in the supply chain, commission a DTG compromise assessment to validate that no secondary persistence exists in the environment, not only in Salesforce but across connected platforms.

Conclusion

The Klue supply-chain attack is a significant SaaS security incident for 2026. It shows how quickly risk can build when non-human identities, service accounts, API tokens, and OAuth grants are treated as routine infrastructure instead of privileged access. A single dormant credential left active for four years exposed an attack surface spanning hundreds of organizations and millions of CRM records.

The second extortion actor reinforces a point DTG has long emphasized: negotiation or payment does not guarantee data recovery or containment. Once sensitive data leaves the environment, its distribution is no longer within the victim's control.

The strategic implication is straightforward: compromised SaaS integrations, OAuth token theft, and downstream CRM exfiltration are now proven attack patterns. Threat actors have found a scalable and often under-monitored attack surface. Organizations that have not inventoried, scoped, and monitored their SaaS OAuth integrations now face measurable exposure.

DTG Threat Management recommends immediate action based on the prioritized recommendations in this brief. DTG can support organizations that need digital forensics and incident response (DFIR) support, SaaS integration audits, compromise assessments, or tabletop exercises.