TLDR Tech / InfoSec
Salesforce Data Thefts Continue via Klue App Compromise
Attackers used a compromised Klue integration account to mint OAuth tokens, query Salesforce REST APIs, and pull CRM data over about 24 hours, including bursts of nearly 1,000 queries in 15 minutes. Huntress reports copied contacts, quotes, and messaging, and ties the incident to a long‑unused Klue credential and the Icarus extortion group using a Session ID and hijacked Australian mail domains. Recommended actions include revoking all Klue‑related secrets, reviewing API query patterns, and enforcing IP allowlists on integration accounts.
Read the full story