On June 11–12, 2026, Klue, a competitive intelligence platform used by sales and marketing teams, detected unauthorized activity inside its integration infrastructure.
The intrusion had not exploited a vulnerability in Klue's product, in Salesforce or in an employee account. Instead, attackers used a dormant legacy credential to get into Klue’s backend. It dated back to 2022, originally created for an integration prototype that was never shipped. From there, they stole OAuth tokens belonging to Klue's customers and used those tokens to reach downstream Salesforce environments.
By the time affected companies began disclosing publicly in mid-to-late June, at least a dozen organizations had confirmed impact
This indluded LastPass, HackerOne, Recorded Future, Tanium, Huntress, ReliaQuest, Jamf, Sprout Social, Gong, Insurity, OneTrust and Snyk. A few more were named on the attackers' leak site before it went offline, bringing the likely total closer to 15.
LastPass learned of the breach on June 12 but didn't disclose publicly until June 23. More importantly than any single company's name, the incident highlighted the emergence of a new type of supply chain attack: one that targets identity and trust relationships rather than software vulnerabilities.
Unlike traditional supply chain attacks such as SolarWinds, the Klue incident didn’t distribute a poisoned software update to victims. Malicious code was involved: the attackers modified Klue's own backend to harvest customer OAuth tokens. But that code never ran inside victim environments.
In SolarWinds, attackers pushed a trojanized update to thousands of customers and executed inside their networks. In Klue, the malicious code stayed on Klue's infrastructure, and the compromise reached downstream organizations entirely through stolen OAuth tokens. The attackers abused trust relationships rather than software distribution, turning a legitimate SaaS integration into a gateway to customer environments.
What happened at Klue?
Klue integrates with systems such as Salesforce and Gong to help organizations collect and distribute competitive insights.
The intrusion began when attackers gained access to Klue's backend using that leftover 2022 prototype credential, which had remained active long after it was no longer needed. Once inside, the attackers modified part of Klue's integration infrastructure to collect OAuth tokens from customers connected to Salesforce and Gong environments through Klue. Salesforce was the primary exfiltration target.
Those tokens effectively became the attackers' access keys
Using the stolen credentials, the attackers authenticated to Salesforce as the legitimate Klue integration and accessed customer CRM data through the Salesforce API. The requests originated from a trusted and authorized application. There was no need to compromise user accounts, bypass multi-factor authentication or exploit Salesforce itself. Salesforce responded by disabling the Klue Battlecards app integration platform-wide. The company stated publicly that the issue was confined to Klue's app connection and didn’t stem from any vulnerability in the Salesforce platform.
The stolen data types in the Klue breach included:
-
Business contacts
-
Sales communications
-
Support cases
-
Pricing information
-
Opportunity notes
Beginning around June 16, affected organizations started receiving extortion emails from a threat actor identifying itself as Icarus, threatening to publish the stolen information unless victims initiated negotiations. Icarus is a newly identified group, active only since late April 2026. This wasn't an established, known actor repurposing old infrastructure, but a young group whose entire track record so far centers on this single campaign.
LastPass was among the organizations that later disclosed exposure. The company stated that the attackers accessed customer-related information stored in Salesforce, including names, email addresses, phone numbers, physical addresses and support case content. LastPass said its products, infrastructure and customer password vaults were not affected.
Why the Klue attack worked
The most interesting aspect of the Klue breach is what the attackers never had to do.
They never had to defeat MFA. They never had to compromise an identity provider. They never had to exploit Salesforce.
Instead, they simply inherited trust that organizations had already granted to Klue
Organizations often view OAuth integrations as operational conveniences, but they effectively function as privileged identities. Authorizing a third-party application grants it its own access path into business systems. If an attacker steals the associated OAuth token, they inherit the permissions granted to the application.
The attackers didn’t steal authentication; they stole already authenticated trust
We've seen attacks like this before
The Klue incident wasn’t a one-off. It was the third major Salesforce-ecosystem OAuth attack in under a year.
In August 2025, a threat actor tracked as UNC6395 executed a remarkably similar attack against Salesloft's Drift platform. Using stolen OAuth tokens tied to Drift integrations, the attackers accessed Salesforce environments belonging to hundreds of organizations. Confirmed victims include Cloudflare, Palo Alto Networks, Proofpoint, Zscaler and Tanium.
Three months later, in November 2025, Salesforce disclosed a related incident involving Gainsight-published applications. The attackers were attributed to ShinyHunters, though Salesforce and Gainsight never officially confirmed it. They abused OAuth tokens tied to Gainsight's Salesforce Connected App, apparently using access that traced back to the earlier Drift breach.
Salesforce and Gainsight initially confirmed only a small number of affected customer orgs, but the attackers separately claimed to have obtained roughly 285 additional Salesforce tokens. A later Gainsight investigation suggested the token set in question was actually several years old. Even with that uncertainty, the shape of the attack matched the others: compromise a trusted SaaS vendor, harvest OAuth tokens and use them to reach Salesforce data across many downstream customers.
Rather than targeting Salesforce directly, each of these attackers exploited trust that customers had already delegated to a third-party application. In the Drift case, that meant exporting CRM data and searching for embedded secrets: cloud credentials, API keys, authentication tokens, and passwords stored within support cases and internal communications.
The vendors, victims, and threat actors differed each time. But the underlying playbook was strikingly similar:
-
Compromise a trusted SaaS provider.
-
Steal customer OAuth tokens.
-
Access downstream Salesforce environments.
-
Exfiltrate sensitive business data.
-
Monetize the breach through extortion or follow-on attacks.
Three incidents in under 12 months suggest this is no longer an isolated pattern. It's a repeating one.
The evolution of supply chain attacks and what's different now
For years, supply chain attacks focused on software packages, update mechanisms and development pipelines. The goal was to compromise software distributed to large numbers of downstream customers.
Klue, Gainsight and Drift demonstrate a different model. Attackers aren’t targeting code distribution anymore. They’re targeting trust.
Modern organizations connect dozens of SaaS applications to core business systems such as Salesforce, Microsoft 365, Google Workspace and ServiceNow. Each integration introduces a new identity, a new set of permissions and a new attack path.
Compromising a single SaaS provider can provide access to a dozen or more customer environments at once without ever directly interacting with the victims. As Huntress has noted, the confirmed victim count likely understates the true scope. Many affected Klue customers have yet to come forward.
Across Drift, Gainsight, and Klue, OAuth tokens became the supply chain.
The identity security lesson
Organizations invest heavily in protecting employee identities through MFA, conditional access, privileged access management and threat detection. Yet many third-party applications retain broad, long-lived access to business-critical platforms with far less oversight.
The Klue incident is a reminder that OAuth integrations are not simply software connections. They are privileged identities. A four-year-old credential from an abandoned integration prototype is exactly what security reviews tend to miss.
The lesson from Drift, Gainsight and Klue is straightforward: attackers no longer need to break into organizations when they can simply inherit the trust organizations have already granted to someone else.
FREE EBOOK
Why the future belongs to the platform
