Klue OAuth Breach Linked to 'Icarus' Salesforce Data Theft Attacks

**Executive summary:** Klue disclosed that the Icarus group exploited OAuth tokens in Klue's Salesforce integrations to access and exfiltrate customers' CRM data (contacts, deal pipelines, notes) and is using the stolen data in an active extortion campaign; the report highlights OAuth token harvesting, lateral SaaS pivoting, low-noise persistence, and recommends auditing/revoking connected apps and tokens.