Global – – October 19, 2026 -- Salesforce has disabled all Klue integrations after the threat group Icarus claimed on 19 June 2026 to have exfiltrated customer data through the market intelligence platform's Salesforce connection. Matching data points give high confidence that Icarus is behind the supply chain attack, according to the source analysis.
Attackers pushed token-stealing code on 11 June
The compromise began on 11 June, when anomalous behavior occurred in a system connecting Klue's various integrations. Attackers pushed a code update that could collect the OAuth tokens customers use to connect Klue to their own systems. Klue noticed the activity on 12 June, including unusual network connections to IP addresses the actor used to run commands on its backend servers.
On 13 June, Klue staff disabled the remote access, removed the token-theft code and sent customers a general alert. The alert did not say which customers were affected.
Dormant credential gave attackers initial access
Huntress understands the actor used a long-disused but still active credential that Klue had created for a third-party integration prototype it later abandoned. The attackers then moved into Klue's infrastructure, stole OAuth tokens and queried customers' CRM tools directly.
Most malicious Salesforce requests targeted the /services/data/v59.0/query/ endpoint. They used a User-Agent of 5238 or a blank one, and nearly 900 queries used Python-based User-Agent strings. Some affected companies report that Salesforce and Gong data was successfully exfiltrated.
Exposed data spans contacts, pricing and deal notes
The affected data may include business names, products trialed or used, and subscription details such as units and pricing. It may also include full names, work emails, job titles, phone numbers and business addresses, plus marketing and sales communications. Free-form opportunity notes, where teams record thoughts and next steps, may also be exposed.
Recorded Future, Tanium and Jamf have issued statements on the impact to their data. More statements are expected as other companies verify what was touched.
Extortion emails gave victims 48 hours
On 16 June, staff at some targeted companies received emails titled "top secret email" saying their data had been downloaded and that they had 48 hours to respond. The emails came from domains of subsidiaries of Australian retailer Global Retail Brands: house.com.au, robinskitchen.com.au and baccarat.com.au. Huntress believes the adversary used the retailer's mail server as compromised infrastructure.
Icarus told Klue to make contact for "a swift resolution" and told affected companies to reach it via Session to protect their data. The group says on its website that it has been active since 28 April 2026 and lists two earlier victims. It has historically posted samples of stolen data on the dead-drop site gofile.io.
Klue lists four IPs in Netherlands, France and Ukraine
Klue's notification includes a non-exhaustive list of four IP addresses, hosted by ISPs in the Netherlands, France and Ukraine: 138.226.246.94, 212.86.125.24, 213.111.148.90 and 94.154.32.160. The first is also linked to spam campaigns from March 2026.
Responders urged to revoke sessions, not just integrations
Because the attack relied on harvested credentials, revoking integrations may not be enough. The source advises revoking all active sessions for known-affected services. It also recommends cross-referencing Salesforce, Klue and other OAuth application logs against the IOCs, and requesting missing logs from vendors as part of an active security investigation. Spam folders should be checked for the extortion emails, and any found should be kept for forensics. Companies that find evidence of exfiltration should engage their cyber insurance provider, and all dormant OAuth and third-party integration credentials should be audited and deactivated.