More Salesforce customers have been breached through abuse of a trusted third-party application integration, this time involving Klue’s Battlecards app.
The incident came to light on June 17, when Salesforce suspended the Battlecards integration after detecting unusual activity that may have allowed unauthorized access to a subset of customer data through the app’s connection to Salesforce.
Salesforce emphasized that the issue did not come from a vulnerability in the Salesforce platform itself. Instead, the incident was tied to Klue’s app connection and to the abuse of OAuth tokens to access integrated customer environments.
The case is the latest reminder that SaaS integrations are now among the most important yet least-monitored paths to sensitive business data.
What Happened?
Threat actors gained access to Salesforce environments by abusing OAuth tokens associated with Klue’s integration.
According to ReliaQuest, attackers authenticated through a compromised Klue integration service account and generated OAuth tokens that gave them access to connected Salesforce instances.
Once inside, the attackers used automated Python scripts to extract data through the Salesforce REST API.
In at least one observed environment, the activity included nearly 1,000 queries in 15 minutes, followed by sustained data exfiltration over several hours.
This pattern suggests a focused bulk-extraction operation. The attackers appeared to enumerate available data, extract what they could access, and move on.
Klue Backend Compromise
Huntress, one of the affected organizations, disclosed that its Salesforce data was compromised through the incident.
According to Huntress, the attackers breached a backend system connected to Klue’s market intelligence platform.
The compromise reportedly began on June 11, when anomalous behavior appeared in a system used to connect Klue with various third-party software platforms.
The attackers pushed a code update capable of collecting OAuth tokens that Klue customers used to connect Klue to their own systems.
Huntress said the initial access appears to have come from a long-disused but still active credential that had been created for testing a third-party integration that was never ultimately deployed.
That unused credential became the entry point.
Why OAuth Tokens Are So Dangerous
OAuth tokens are designed to let apps access data and services without requiring users to repeatedly enter passwords.
This is useful and necessary for SaaS integrations, but it creates serious risk when tokens are stolen or abused.
If an attacker obtains a valid OAuth token, they may be able to access connected systems as if they were the trusted application.
That access can bypass many traditional security controls because:
- the connection appears legitimate
- the app is already approved
- the token may have broad permissions
- API activity may look like normal integration behavior
- no user password is needed
- MFA may not be triggered
- access can continue until the token is revoked
This is why OAuth token theft is now a major SaaS security risk.
A Familiar Playbook: Salesloft Drift, Gainsight, and Klue
ReliaQuest noted that the Klue incident follows the same third-party OAuth-abuse pattern seen in previous Salesforce ecosystem breaches involving Salesloft Drift and Gainsight.
The common pattern is simple:
- A trusted SaaS integration is compromised.
- Attackers collect or abuse OAuth tokens.
- The tokens provide access to customer Salesforce environments.
- Attackers use APIs to enumerate and extract data.
- Victims may not notice immediately because the activity appears to come through a legitimate integration.
This is a supply chain problem inside the SaaS ecosystem.
Organizations may secure Salesforce itself but still expose data through connected apps with long-lived tokens and broad API permissions.
What Data Was Exfiltrated?
The exact scope varies by customer and integration permissions.
Huntress disclosed that the stolen Salesforce data included:
- business contacts
- price quotes
- sales-related data
- sales-related messaging
Other affected organizations may have exposed different data depending on what their Klue integration could access.
In many organizations, Salesforce contains sensitive commercial information such as:
- customer contacts
- sales opportunities
- pricing data
- deal notes
- contracts
- renewal details
- partner information
- pipeline data
- internal communications
- account history
Even if this data does not include passwords or payment card data, it can still be highly valuable for extortion, competitive intelligence, phishing, and business email compromise.
Other Platforms May Have Been at Risk
Klue CEO Jason Smith said attackers used OAuth tokens to access certain third-party platforms, including Salesforce, and then accessed data in several connected customer environments.
Klue reportedly disabled its integration with Salesforce and several other apps, including:
- HubSpot
- Microsoft SharePoint
- Zoom
- Google Drive
It remains unclear which additional platforms, if any, were compromised.
This uncertainty is important because SaaS integrations often connect across multiple business systems. A compromised integration token may open more than one door.
Possible Link to Icarus
Previous Salesforce-related attacks were associated with ShinyHunters, but this latest wave appears to involve a different group known as Icarus.
Huntress received an extortion email from threat actors claiming to possess stolen Salesforce data and threatening to go public unless the company made “the right decision.”
The email included a unique Session messenger key for negotiation.
Huntress found that the Session ID matched values listed on the dark web leak site of Icarus, an emerging threat group that appeared in April.
The group’s leak site had one listed victim at the time, and a June 12 post warned that “big corps” were coming.
This suggests the Klue incident may be part of a broader extortion operation.
Abuse of Compromised Corporate Email Infrastructure
Huntress also found that the extortion emails were sent from three corporate mail domains belonging to Global Retail Brands, an Australian appliance and home goods retailer.
Investigators believe Icarus actors may have compromised the retailer’s infrastructure and used its mail server for malicious activity.
This adds another layer to the campaign.
Attackers may be combining stolen SaaS data, compromised integrations, and abused corporate email infrastructure to make extortion attempts look more credible and harder to block.
Huntress reported the activity to the Australian Cyber Security Centre.
Why SaaS Integrations Are High-Value Targets
SaaS integrations are attractive because they often hold trusted access across multiple environments.
A single integration can connect to:
- Salesforce
- HubSpot
- SharePoint
- Google Drive
- Zoom
- Slack
- email platforms
- customer support tools
- marketing systems
- analytics platforms
These integrations often rely on OAuth tokens, service accounts, API keys, and long-lived credentials.
If attackers compromise the integration provider or an old credential inside its environment, they may gain access to many customers at once.
This is why SaaS integrations must be treated like privileged infrastructure.
What Organizations Should Do Now
ReliaQuest recommended that organizations immediately revoke and reissue everything tied to the Klue integration.
That includes:
- service account passwords
- refresh tokens
- client secrets
- active OAuth grants
- connected app permissions
Organizations should also review Salesforce API activity for unusual behavior.
Key actions include:
- revoke Klue OAuth tokens
- reissue affected secrets
- rotate integration credentials
- review connected apps in Salesforce
- identify all Klue-related access
- inspect Salesforce REST API activity
- monitor for high query volumes
- review data exports
- check for unusual service account activity
- enforce IP allowlisting for integration accounts
- restrict third-party app access to approved sources
- review permissions granted to all SaaS integrations
If suspicious API activity is found, assume data may have been accessed and begin incident response.
Detection Opportunities
Security teams should look for signs of OAuth abuse and API-based data theft.
Useful signals include:
- sudden spikes in Salesforce REST API queries
- unusual API access from Klue-related accounts
- data exports outside normal business hours
- service account access from unexpected IP addresses
- high-volume queries over short time periods
- OAuth token generation anomalies
- new or unusual connected app activity
- access to objects not normally used by the integration
- repeated enumeration of Salesforce records
- API activity followed by extortion contact
Detection should focus on behavior, not just known indicators.
The attacker may use legitimate tokens and authorized APIs, so the activity may not look like a traditional intrusion.
Reduce SaaS Integration Risk
Organizations should review all third-party SaaS integrations, not only Klue.
Recommended controls include:
- maintain an inventory of connected apps
- review OAuth scopes regularly
- remove unused integrations
- revoke old tokens
- rotate long-lived credentials
- enforce least privilege for service accounts
- restrict integration access by IP where supported
- require vendor security reviews
- monitor API usage patterns
- alert on abnormal query volume
- review who can approve new connected apps
- separate high-risk integrations from sensitive data where possible
A connected app should not have more access than it needs.
The Bigger Lesson: Trusted Apps Need Continuous Verification
This incident shows that trust in SaaS integrations cannot be static.
A third-party app may be trusted today and compromised tomorrow. An old credential may be forgotten but still active. A backend integration may silently collect tokens. A legitimate API may be used for mass exfiltration.
That means organizations need continuous verification.
Security teams should know:
- which apps are connected
- what data each app can access
- which accounts the apps use
- which tokens are active
- where API calls come from
- whether behavior matches the app’s normal use
- whether unused credentials still exist
- who owns each integration internally
Without that visibility, SaaS integrations become blind spots.
Final Thoughts
The Klue Battlecards incident is another warning that Salesforce security does not end at Salesforce.
Attackers increasingly target the trusted integrations that connect to Salesforce and other SaaS platforms. By abusing OAuth tokens, they can access sensitive customer data through legitimate API paths that may bypass traditional detection.
The pattern has now repeated across multiple incidents, including Salesloft Drift, Gainsight, and Klue.
Organizations should revoke and reissue Klue-related credentials, review Salesforce API activity, enforce IP allowlisting, and audit all third-party connected apps.
The key lesson is simple: every SaaS integration is a potential access path. If it has OAuth tokens, API permissions, and trusted access to business data, it must be monitored like a privileged account.
