Following an OAuth attack at Klue, CRM data has been stolen from Salesforce environments.
Market intelligence platform Klue has fallen victim to an OAuth breach, in which threat actor Icarus stole CRM data from Salesforce environments. Companies using the Klue Battlecards integration received extortion emails from the alias ‘mr bean’.
The attack came to light when several organizations reported that their Salesforce data had been stolen. Research firms ReliaQuest and Huntress confirmed the breach, with Huntress even admitting to being a victim itself.
How the attackers operated
Attackers gained access to the Klue Battlecards integration service and used OAuth tokens linked to customer-specific Salesforce instances. Using automated Python scripts, they searched the Salesforce REST API for nearly 24 hours. They first conducted reconnaissance via the ‘/services/data/v59.0/sobjects’ endpoint, before exfiltrating data via ‘/services/data/v59.0/query’.
At one organization, the attackers performed nearly a thousand queries within a 15-minute timeframe. ReliaQuest notes that the activity strongly resembled previous attack patterns by ShinyHunters, but the actual perpetrator turned out to be the new group Icarus.
Approach and consequences
Salesforce disabled the Klue Battlecards integration as a precaution. Klue, in turn, deactivated integrations with Salesforce, HubSpot, SharePoint, Zoom, and other platforms. The stolen data includes CRM information, sales communications, and price quotes.
Organizations using Klue integrations are advised to check their Salesforce and SaaS logs for activity originating from specific IP addresses, revoke OAuth tokens, and terminate active sessions.
Icarus, active since April 2026, has already posted two victims on its data leak website. The group appears to target large companies, with a warning message: “big corps getting listed. be ready.”