Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data

Salesforce disabled the Klue Battlecards app after a June 11, 2026 compromise of Klue that exposed stored OAuth tokens used to access downstream customer Salesforce orgs, resulting in CRM data exfiltration; affected customers (including Huntress and Recorded Future) are being notified and advised to revoke tokens, pull Event Monitoring logs for June 11–19, and audit connected apps. The incident — linked to the Icarus campaign — highlights OAuth token abuse in SaaS-to-SaaS integrations as a high-impact supply-chain attack vector.