OAuth tokens robbery in Klue opens the door to extortion against Salesforce customers

A failure in the integration of the Klue market intelligence platform allowed attackers to steal Salesforce CRM data and launch a extortion campaign against affected customers; public investigations of cyber security companies such as ReliaQuest and Huntress have confirmed the main technique used: the theft and use of OAuth tokens to consult Salesforce APIs on behalf of customers.

The attack takes advantage of a classic weakness in third-party confidence chains: instead of compromising individual accounts within the CRM, the attackers entered through the integration of Klue, removed tokens OAuth and used them to make automated consultations to Salesforce's REST endpoints - first mapping exposed objects and then downloading specific records - during windows that, in some cases, varied from a few hours to intense bursts of consultations.

The technical lesson here is clear: the possession of an OAuth token is equivalent, in many scenarios, to the possession of a temporary master key. Integrations with extensive permissions and active persistent credentials represent a critical risk if the supplier is engaged or malicious code is deployed from its environment.

The actor who claims responsibility for extortion is identified as "Icarus," a relatively new group that has begun to publish victims and to send rescue demand posts; this makes data theft a direct threat to the reputation and commercial security of the organizations concerned, in addition to the risk of exposure of contacts, sales communications and quotations that Huntress mentions in his report. For technical details and the official response of Salesforce you can see the status note of the platform at Salesforce Status, and analysis of malicious activity and indicators are available in the reports of ReliaQuest and Huntress in ReliaQuest and Huntress.

What should security and IT teams do now: to audit and rotate all OAuth tokens linked to Klue integrations and similar products; to finish active sessions and force new authentication; to review API and IMS logs in search of activity towards the REST endpoints that disseminated data; and to seek activity from IP addresses associated with the attack, such as 138.226.246.94, 212.86.125.24, 213.11.148.90 and 94.154.32.160. These actions reduce the abuse window and help to rebuild the chain of events for response and regulatory reports.

It is not enough to react: it is necessary to tighten the model of trust to suppliers. Review the principle of lower privilege in OAuth scopes, set short-term for tokens and service credentials, implement automatic rotation where possible and apply conditional access controls (geolocation blocking, IP requirements, session risk assessment). In addition, they require suppliers to secure deployment processes and code integrity monitoring to reduce the risk of a malicious update stealing credentials.

From an operational perspective, the organizations concerned should activate their incident response plan: keep evidence, coordinate with the supplier (Klue), Salesforce and their legal teams, prepare communications to clients and regulatory supervisors, where appropriate, and consider the recruitment of external forensic response to assess the actual extent of exfiltration.

Long-term detection and prevention: security teams should instruct alerts that detect metadata recognition patterns in APIs (unusual list of objects, automated query bursts), use intrusion tests and attack simulation to validate controls (break and attack simulation) and strengthen the telemetry of SaaS integrations so that any use of third party credentials is quickly detectable.

Finally, do not underestimate the reputational risk and the possibility of extortion: keep a record of the actor's communications, not negotiate without legal advice and put in place technical and communication mitigation measures. To keep up-to-date and download public commitment indicators, review the analysis and response guides of intelligence providers such as the links mentioned above and the official CRM service alerts.