Icarus hijacked Klue OAuth to loot Salesforce CRM data
Klue’s Battlecards integration was compromised, allowing the Icarus group to harvest OAuth tokens and query connected Salesforce instances. The attackers exfiltrated CRM records and then launched extortion campaigns against the affected customers, prompting Salesforce to disable the Klue app. This supply‑chain breach highlights the risks of third‑party SaaS connections.