Salesforce Data Thefts Continue via Klue App Compromise

The report describes the Icarus campaign, where attackers compromise third-party SaaS apps (e.g., Klue Battlecards) and abuse long-lived, over-permissioned OAuth/API credentials to exfiltrate Salesforce CRM data across many customer organizations; Huntress is confirmed as a victim. The campaign demonstrates a high-impact SaaS-to-SaaS supply-chain risk and recommends OAuth token audits, least-privilege scopes, third-party security assessments, connected-app monitoring, and rapid token revocation runbooks.