Icarus Claims Klue Breach; Salesforce Disables Integrations
Global – – October 19, 2026 -- Salesforce has disabled all Klue integrations after the threat group Icarus claimed on 19 June 2026 to have exfiltrated customer data through the market intelligence platform's Salesforce connection. Matching data points give high confidence that Icarus is behind the supply chain attack, according to the source analysis.
Attackers pushed token-stealing code on 11 June
The compromise began on 11 June, when anomalous behavior occurred in a system connecting Klue's various integrations. Attackers pushed a code update that could collect the OAuth tokens customers use to connect Klue to their own systems. Klue noticed the activity on 12 June, including unusual network connections to IP addresses the actor used to run commands on its backend servers.
On 13 June, Klue staff disabled the remote access, removed the token-theft code and sent customers a general alert. The alert did not say which customers were affected.