Cybersecurity Firms Impacted by Klue Supply Chain Attack

Klue's Salesforce integration was compromised by the Icarus campaign, allowing attackers to steal OAuth tokens and query downstream customer Salesforce tenants to exfiltrate CRM data from organizations including Huntress and Recorded Future; Salesforce has disabled the Klue app and affected customers are advised to audit connected apps, review logs, and revoke/rotate tokens.