Klue Breach Enables Hackers to Compromise Cybersecurity Firms via OAuth Tokens

Klue detected an intrusion on June 12 in which a compromised legacy credential allowed attackers to access the Klue Battlecards integration, steal OAuth tokens, and impersonate Klue to access and exfiltrate customer data from connected Salesforce instances; several cybersecurity firms and other customers were affected, Klue revoked tokens, removed malicious code, engaged CrowdStrike for forensics, and the extortion group Icarus claimed the breach.