Campaign DetailSource-backed corpus

Klue Salesforce OAuth Supply-Chain Attack

A compromised legacy credential in Klue integration infrastructure enabled OAuth-token access to connected Salesforce environments. The campaign is retained as a third-party SaaS supply-chain and CRM data-exposure scenario, with Icarus included as a source-bound analytical lead that requires deconfliction from other public actor reporting.

Last updated Jul 12, 2026, 2:48 PM EDT

Actor Mapping

Mapped Threat Actors

Icarus

Targeting

Target Sectors / Countries

TechnologySaaSFinancial ServicesInsuranceSecurityCross-industry

Tradecraft

ATT&CK / Techniques

T1528T1530T1213

Tools / Observables

Malware, Tools, CVEs

Compromised legacy integration credentialOAuth refresh tokensSalesforce REST API

Source Reconciliation

How IntelliOS Is Treating This Campaign

Campaign rows are retained as source-backed context. Actor mappings do not automatically merge actor records; SOCRadar, MITRE, Mandiant, CrowdStrike, Microsoft, and other future sources can disagree on boundaries, aliases, or campaign ownership.

The Klue/Salesforce incident does not establish a Salesforce platform vulnerability or prove that Icarus caused every related event. Treat Icarus as an evidence-weighted analytical lead and validate with current source reporting and authorized telemetry.

Evidence Controls

Methodology / Claim Status

Reporting period: June 2026
Methodology: Telemetry across impacted Salesforce organizations and vendor-reported incident mechanics
Sample scope: Multiple affected Salesforce tenants analyzed by Obsidian
Claim status: OAuth abuse observed; Icarus attribution remains source-bound

IntelliOS

Related Intel Products

Flash Threat BriefKlue Supply Chain AttackPANDA brief with source-backed Klue/Salesforce OAuth incident context and response boundaries.Threat Actor ProfileIcarus Threat Actor ProfilePANDA actor profile with attribution caveats and related SaaS-token abuse context.Flash Threat Intel BriefSalesloft Drift OAuth Supply-Chain AttackComparator brief for adjacent Salesforce OAuth-token theft and supply-chain exposure context.

Citations

Source Trust / Citations

[1] Obsidian: Icarus / Klue Salesforce integration analysisObsidian Security
[2] Klue: An Update on the Recent Klue Security IncidentKlue
[3] Salesforce: Update on Recent Salesforce Data Theft IncidentsSalesforce