Full Report
For the latest discoveries in cyber research for the week of 22nd June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Texas Parks and Wildlife Department has been affected by a third-party data breach involving its license system vendor. The incident exposed driver’s license information, passport numbers, emails, phone numbers, and residential addresses for […] The post 22nd June – Threat Intelligence Report appeared first on Check Point Research.
Analysis Summary
# Incident Report: Klue OAuth Token Breach & Supply Chain Exploitation
## Executive Summary
The market intelligence platform Klue suffered a data breach after attackers exploited compromised legacy integration credentials to bypass security controls. This allowed the "Icarus" extortion group to steal OAuth tokens, granting unauthorized access to the Salesforce environments of high-profile clients. The incident highlights the critical risk of "zombie" legacy credentials and the cascading impact of third-party OAuth compromises.
## Incident Details
- **Discovery Date:** Reported June 2026
- **Incident Date:** Mid-to-late June 2026
- **Affected Organization:** Klue (and its clients including Huntress, Recorded Future, Tanium, and Jamf)
- **Sector:** Technology / Market Intelligence / Cybersecurity
- **Geography:** Global / North America
## Timeline of Events
### Initial Access
- **Date/Time:** June 2026
- **Vector:** Compromised legacy integration credentials.
- **Details:** Attackers gained access to Klue’s infrastructure by utilizing old, valid credentials from a legacy integration that had not been decommissioned or rotated.
### Lateral Movement
- **Details:** Once inside the integration environment, the threat actors accessed the database or configuration files containing OAuth tokens. These tokens acted as "keys" to move from Klue’s environment into the Salesforce instances of their customers.
### Data Exfiltration/Impact
- **Details:** Using the stolen OAuth tokens, the Icarus extortion group exfiltrated sensitive sales data and customer records directly from the Salesforce environments of Klue’s high-profile cybersecurity clients.
### Detection & Response
- **How it was discovered:** Likely identified through unauthorized access alerts within customer Salesforce environments or via the public claim by the Icarus extortion group.
- **Response actions taken:** Klue confirmed the breach and invalidated the compromised OAuth tokens. Affected clients were notified to revoke permissions and audit their Salesforce logs.
## Attack Methodology
- **Initial Access:** Valid Accounts (Legacy Credentials).
- **Persistence:** OAuth Token hijacking (maintained access even if the primary legacy password was changed, until tokens were revoked).
- **Privilege Escalation:** Not explicitly detailed, but inherited the permissions of the OAuth integration.
- **Defense Evasion:** Use of legitimate OAuth flows to mask unauthorized API calls as standard integration traffic.
- **Credential Access:** Theft of OAuth tokens from legacy integration databases.
- **Lateral Movement:** Inter-platform movement (Klue → Salesforce).
- **Collection:** Automated API-based data harvesting.
- **Exfiltration:** Direct exfiltration from third-party SaaS (Salesforce) to attacker-controlled infrastructure.
- **Impact:** Data theft and extortion.
## Impact Assessment
- **Financial:** Potential for significant legal fees, regulatory fines, and loss of business from enterprise clients.
- **Data Breach:** Exposure of proprietary sales strategies, customer lists, and sensitive CRM data for multiple Fortune 500-level companies.
- **Operational:** Disruption to Klue’s integration services while security remediation took place.
- **Reputational:** High; several major cybersecurity firms (who are Klue customers) were victims, creating a secondary reputational hit for the security industry.
## Indicators of Compromise
- **Network Indicators:** Unusual API traffic originating from IP ranges not associated with Klue’s standard infrastructure (Note: Specific IPs not provided in summary).
- **Behavioral Indicators:**
- Bulk data exports from Salesforce via the Klue integration.
- Login activity using legacy credentials that had been dormant for an extended period.
## Response Actions
- **Containment:** Immediate revocation of all active OAuth tokens associated with the compromised integration.
- **Eradication:** Decommissioning of the legacy integration system and rotation of all service account passwords.
- **Recovery:** Restoration of secure sync services for clients after confirming the integrity of the new integration environment.
## Lessons Learned
- **Credential Hygiene:** Legacy systems and old integrations represent a significant "forgotten" attack surface that must be audited and decommissioned.
- **Token Security:** OAuth tokens should be treated as highly sensitive secrets, encrypted at rest, and ideally limited in scope (Least Privilege).
- **Third-Party Risk:** Organizations must monitor the activity of third-party integrations with the same rigor as internal user accounts.
## Recommendations
- **Implement JIT (Just-In-Time) Access:** Use temporary credentials for integrations where possible.
- **Regular Audit:** Conduct quarterly reviews of all API integrations and decommission any that are not actively supporting a business process.
- **SaaS Security Posture Management (SSPM):** Use tools to monitor Salesforce (and other SaaS) for anomalous data export behavior by third-party apps.
- **MFA on Service Accounts:** Where supported, enforce strict access controls on the administrative accounts managing these integrations.