A Four-Year-Old Credential
On June 12, Klue, a competitive intelligence platform used by sales and marketing teams, discovered something was wrong inside its integration systems. When the investigation wrapped up, the root cause turned out to be almost mundane: a legacy service account credential, reportedly around four years old, that nobody had rotated or retired.
That is the whole story, really. Not a zero-day. Not an especially sophisticated exploit chain. A credential that should have been killed off years earlier, still sitting there, still valid, still connected to production systems.
What Happened After the Attacker Got In
Once inside, the attacker pushed a malicious code update into Klue's integration infrastructure, built to do one specific thing: harvest the OAuth tokens connecting Klue to its customers' other business tools. Salesforce was the primary target, but the same mechanism reached connections to Gong, HubSpot, and Slack as well.
With valid OAuth tokens in hand, the attacker did not need to break into anything else. They wrote automated scripts that called Salesforce's own REST API endpoints, the same ones Klue's legitimate integration used every day, and systematically pulled data out: business contacts, price quotes, internal sales communications, and account records. To Salesforce's systems, the requests looked exactly like what they were supposed to look like, because the tokens making them were real.
Roughly 200 companies were affected. Some of the confirmed names are notable for a reason that should sting a little: Huntress, Recorded Future, and Tanium, three cybersecurity companies, were on the list, alongside Jamf, Gong, Sprout Social, and Insurity. An extortion group calling itself Icarus claimed responsibility and began pressuring victims directly through emails and a leak site. Salesforce's response was to disable Klue's Battlecards app integration platform-wide, cutting off the attacker's access path for every remaining customer at once.
This Was Not an Isolated Incident
A few weeks earlier, a much larger campaign hit more than 700 organizations through a similar mechanism: stolen OAuth tokens tied to the Salesloft Drift integration with Salesforce. That attacker, tracked as UNC6395, spent roughly ten days in June pulling data out of connected Salesforce instances, with particular interest in support case text, where employees had pasted things like AWS keys, Snowflake tokens, VPN credentials, and plaintext passwords while troubleshooting issues.
Two separate incidents, two different vendors, the same underlying weakness: a third-party integration holding a long-lived OAuth token that, once stolen, works exactly as well for an attacker as it does for the app it was issued to.
Why OAuth Tokens Are the New Soft Target
Every time a business connects a third-party app to Salesforce, Google Workspace, Slack, or any other core platform, that app receives an OAuth token acting on the company's behalf, often with broad, standing permissions and no expiration date in sight. Most companies can name every employee with access to their CRM. Very few can produce a complete, current list of every app connected to it, what permissions each one holds, and when each token was last used.
That blind spot is exactly what attackers have learned to exploit. Rather than going after Salesforce directly, a well-defended target, they go after the smaller vendor with weaker security that happens to hold a key to the front door.
What Your Business Should Do
Start by inventorying every connected app across Salesforce, Google Workspace, Microsoft 365, and anything else holding sensitive data. If you cannot say what is connected and why, that is the first problem to fix. Kill what you do not use. Any integration nobody remembers setting up, or that was set up by someone who no longer works there, should be revoked outright. A dead integration with a live token is pure risk with no upside.
Rotate tokens and service account credentials on a schedule. A four-year-old credential should never still be active anywhere in your environment. Treat service accounts and app integrations the same way you treat employee passwords, with an expiration date and a rotation policy behind them.
Stop pasting secrets into support tickets and CRM fields. The Salesloft Drift campaign succeeded in part because employees had left API keys and credentials sitting in plain text inside support case notes. Anything typed into a ticket, a chat message, or a CRM note should be treated as something an attacker could eventually read.
Finally, monitor API activity for anomalies. Unusual query patterns, requests against endpoints your integration does not normally use, or a sudden spike in data volume pulled through an API are often the only warning you get before a breach like this becomes public.
The Takeaway
The Klue breach did not require a brilliant attacker. It required an ordinary oversight, left alone for four years, in a system most people never think to audit. That is the uncomfortable truth behind most supply chain breaches: the mechanism is usually simple, and the failure is usually something a routine audit would have caught.
AetherGuard Technologies helps businesses map their third-party integrations, audit OAuth permissions, and build the kind of ongoing credential hygiene that keeps a four-year-old mistake from becoming next year's headline.
