Marketing intelligence platform Klue confirmed this week that an attacker breached its infrastructure using a compromised legacy credential to obtain OAuth access tokens for integrated services, subsequently stealing data directly from Klue customers' Salesforce and Gong instances. Salesforce responded by disabling the Klue Battlecards app integration within its platform, leaving organizations unable to access the service while investigations continue.

The attack illustrates with painful clarity why third-party OAuth integrations represent such a significant and underappreciated attack surface. OAuth tokens function as bearer credentials — anyone holding the token can access the associated resources, regardless of who originally authorized them. When a SaaS platform like Klue accumulates OAuth tokens connecting to dozens of customer environments, it becomes a single point of failure with a blast radius spanning every connected organization.

In Klue's case, the attackers reportedly gained initial access using a "compromised legacy credential" — likely a service account or API key from a deprecated integration that was never properly deprovisioned. This is a textbook example of credential hygiene failure: old credentials, maintained but unmonitored, accumulating in systems long after they should have been rotated or revoked. They represent low-hanging fruit for attackers because they are often outside the scope of regular security reviews.

The cybersecurity firm Huntress was among the customers whose Salesforce data was accessed through Klue's compromised connection — a particularly ironic incident given that Huntress is itself a security company. The extortion group behind the attack, dubbed Icarus, subsequently contacted affected organizations demanding payment in exchange for not releasing the stolen data. Icarus represents the emerging model of financially-motivated threat actors who combine supply chain compromise with targeted extortion, maximizing leverage by simultaneously threatening multiple victims through a single vendor compromise.

Security experts responding to this incident are recommending that organizations immediately audit their OAuth token inventories, revoking any tokens associated with vendors that have recently reported security incidents. More broadly, they advocate for OAuth token management solutions that can centrally monitor, rotate, and revoke third-party application credentials — an area of security that has historically received far less attention than endpoint or network security.