Icarus

Icarus is an emerging data-theft and extortion actor label associated in public reporting with the Klue/Salesforce OAuth incident. In this brief, the topic is not simply whether Icarus is a mature actor name; it is whether source-backed reporting shows a repeatable operational pattern: compromised SaaS integration trust, OAuth-token-backed Salesforce access, CRM data collection, and extortion pressure against downstream organizations. ^{[1, 3, 4, 5, 6, 8, 9]}

The defensible framing is that attackers abused a trusted third-party integration path rather than exploiting Salesforce itself. Klue described unauthorized activity affecting integration infrastructure and OAuth tokens, while Salesforce stated the issue was limited to Klue's app connection and did not arise from a Salesforce platform vulnerability. 03-Jul-2026 · Newly retained (>24h)Klue's CrowdStrike summary newly adds that a compromised GitHub PAT was used to introduce unauthorized code into the integration service and collect third-party integration credentials, including Salesforce OAuth tokens. ^{[1, 2, 3, 5, 34]}

The operational concern is broader than actor naming. Public victimology now includes direct notices and reporting across organizations such as Huntress, LastPass, Jamf, Recorded Future, HackerOne, BeyondTrust, Sprout Social, Pendo, 8x8, Link11, and additional Klue customers, with impact generally framed around Salesforce, CRM, sales, support, business-contact, or customer-relationship data. ^{[4, 7, 15, 18, 19, 20, 21, 22, 23, 24, 25, 28, 29]}

For defenders, the topic should drive action around OAuth app inventory, token revocation, Salesforce API telemetry, suspicious integration-account behavior, data-exposure scoping, and extortion evidence preservation. 03-Jul-2026 · Newly retained (>24h)Klue's remediation summary adds vendor-side hardening themes around PAT elimination, GitHub Apps or short-lived credentials, automated secret scanning, audit logging, SIEM centralization, EDR, CI/CD observability, and GitHub Actions allowlisting. 30-Jun-2026 · Newly retained (>24h)FINRA's alert broadens response to Klue integrations with Salesforce, HubSpot, Gong, SharePoint, Zoom, Chorus, Clari, Google Drive, Slack, and other SaaS platforms. Attribution remains useful, but response should not wait for final confidence on whether Icarus overlaps with any other publicly named SaaS intrusion cluster. ^{[3, 5, 26, 30, 34]}

Icarus is currently best understood as a relatively new extortion actor label tied to Salesforce data theft through compromised SaaS integration trust. Public reporting around the Klue incident says attackers gained access to Klue integration infrastructure through a compromised legacy credential, obtained OAuth tokens used to connect Klue with third-party platforms including Salesforce, and used those tokens to access data in connected customer environments. 03-Jul-2026 · Newly retained (>24h)Klue's CrowdStrike summary newly clarifies that the access involved a previously compromised GitHub PAT used to introduce unauthorized code into Klue's integration service and collect third-party integration credentials, including Salesforce OAuth access and refresh tokens. ^{[1, 3, 4, 5, 6, 8, 34]}

The incident is important because it bypasses the mental model that "the customer's Salesforce was hacked" or that an employee clicked a phish. The more precise model is third-party SaaS supply-chain access: a trusted app connection had access, the token represented that trust, and attackers used it to query CRM data through legitimate Salesforce APIs until the token and integration path were disabled. Salesforce stated the issue was limited to Klue's app connection and did not arise from a Salesforce platform vulnerability. ^{[2, 3, 5]}

Real-world examples make the risk concrete. Huntress publicly disclosed that CRM data such as business contacts, price quotes, sales communications, and competitive reports were impacted, while LastPass later confirmed customer-support and business-contact data exposure through Salesforce and stated that password vaults and core services were not affected. 25-Jun-2026 · AddedThe Icarus AI Monitoring Agent newly retained direct notices from HackerOne, BeyondTrust, Sprout Social, Pendo, LastPass, and 8x8, further supporting the same boundary: Salesforce/CRM or sales-context data exposure through the Klue integration, not proof of core product compromise. ^{[4, 7, 8, 20, 21, 22, 23, 24, 25]}

27-Jun-2026 · Freshly reported (<24h)Fresh victimology reporting now puts the public notification set at roughly two dozen Klue customers and adds AlertMedia, Blackbaud, Camunda, Cresta, Deel, Lucanet, Link11, and Tines to the public-notice picture. 27-Jun-2026 · Newly retained (>24h)The newly retained Link11 direct notice confirms certain Salesforce CRM business-contact and sales-related data exposure while excluding Link11 core systems, products, operational security infrastructure, and customer systems. ^{[28, 29]}

02-Jul-2026 · Newly retained (>24h)Newly retained (>24h) direct-notice coverage adds LogicMonitor/Catchpoint, which confirmed unauthorized access to Catchpoint's Salesforce environment and business relationship / sales activity data exposure while excluding LogicMonitor's primary Salesforce environment and production, monitoring, credential, payment, and operational customer data. 02-Jul-2026 · Newly retained; undatedSaviynt's Trust Portal notice is newly retained with no visible page-publication date and limits potential impact to certain Salesforce sales data while excluding Saviynt products, services, and customer data in Saviynt products. ^{[32, 33]}

05-Jul-2026 · Newly retained; undatedNewly retained (publication date not visible) direct-notice coverage now adds Postman's Security & Trust Portal notice, which confirms customer contact and sales information exfiltration from Salesforce via the compromised Klue service account between June 11-12, while stating customer data was not accessed from Gong and Postman core platform services remained secure and were not impacted. ^[35]

06-Jul-2026 · Newly retained (>24h)Newly retained (>24h) direct-notice coverage adds Deel and Insurity. Deel confirmed a compromised Klue connection exposed business contact and commercial CRM information plus a very limited amount of personal data synced to CRM, while saying the Deel platform itself was not involved. Insurity confirmed suspicious Klue connected-app activity, cloud/product/infrastructure non-impact, CRM business-contact exposure, and a very limited set of active credentials/secrets within CRM data that were rotated or reset. ^{[36, 37]}

08-Jul-2026 · Newly retained (>24h)Newly retained (>24h) direct-notice coverage adds OneTrust, Tines, and Thinkproject. OneTrust described Klue Battlecards OAuth abuse against CRM-related Salesforce data and support-email-related records while excluding customer OneTrust platform data, tenants, passwords, and payment-card data. 19-Jul-2026 · Newly retained (>24h)OneTrust's July 10 update newly adds completed technical investigation, validated scope, finalized containment/remediation, no evidence of exposure beyond OneTrust's Salesforce environment after June 12 containment, and ongoing governance/compliance review. Tines' July 1 update completed its review and limited impact to Salesforce CRM business information, with a small number of sensitive-information cases directly notified and no Tines customer environment, workflow, credential, secret, or token impact. Thinkproject scoped the incident to a Klue-authorized UAT CRM environment and business-contact/commercial information while excluding products and the customer product platform. 08-Jul-2026 · Newly retained; undatedNewly retained (publication date not visible) Cresta, AlertMedia, and ABBYY trust-center notices add direct Salesforce/CRM impact boundaries and product, infrastructure, network, technology, or customer-data non-impact statements. ^{[38, 39, 40, 41, 42, 43]}

09-Jul-2026 · Freshly reported (<24h)Freshly reported (<24h) direct-status coverage adds Snyk's July 8 forensic closure. Snyk said its Mandiant-assisted investigation was complete, the impact was limited to business CRM data, all impacted customers were notified directly, and no evidence of impact to the Snyk platform or sensitive data within it was found. ^[44]

This is closer to extortion-driven SaaS data theft than classic ransomware. Public reporting ties Icarus to leak-site pressure and extortion communications, but the source set does not show file-encrypting malware, network-wide ransomware deployment, or a direct Salesforce platform exploit. The defensible operational framing is therefore: valid SaaS trust was abused, CRM data was queried and exfiltrated, and victims then had to scope downstream exposure and extortion risk. ^{[4, 6, 8, 9, 15]}

03-Jul-2026 · Newly retained (>24h)Klue's July 1 CrowdStrike investigation summary adds containment and boundary detail without changing actor attribution: Klue says Salesforce notified it of suspected unauthorized third-party activity on June 12, Klue disabled affected GKE pods (Google Kubernetes Engine runtime workloads) and compromised GitHub PATs, rotated OAuth credentials, CrowdStrike did not identify evidence of threat-actor access outside systems related to the integration service, and there was no evidence of threat-actor activity in the Klue environment after June 12. ^[34]

26-Jun-2026 · Freshly reported (<24h)Freshly reported (<24h) status reporting adds a caveated live-extortion update: Klue reportedly told customers it remained in contact with Icarus, that Icarus said it was taking steps to delete data, and that the Icarus site appeared down, while a second unnamed actor claimed to have samples for a subset of customers and attempted direct extortion. This does not verify payment, operator identity, a complete data set, a confirmed 195-customer victim count, or full deletion of stolen data. ^[27]

30-Jun-2026 · Newly retained (>24h)Newly retained (>24h) FINRA and ZeroFox sources add actor-tradecraft and hunting precision: FINRA lists suspicious IPs and sender domains shared by companies, while ZeroFox adds suspicious API user agents, "mr bean" direct-email alias corroboration, and a first-observed late-April / early-May 2026 DLS footprint. ZeroFox's possible SLH association remains circumstantial because Icarus has not publicly acknowledged it. ^{[30, 31]}

15-Jul-2026 · Newly retained (>24h)Microsoft's July 13 research adds a source-backed comparator and nomenclature update: it describes mid-2025 to mid-2026 Salesforce abuse using OAuth consent and supply-chain paths associated with ShinyHunters tradecraft, identifies the June 2026 Klue incident as Storm-3138, and recommends Salesforce RTEM, connected-app attribution, app permission insight, high-privilege/unused-app review, risk scoring, and CloudAppEvents hunting. This improves deconfliction and detection guidance but does not merge Icarus with UNC6395/Salesloft Drift or prove a Salesforce platform vulnerability. ^[48]