Topic starter
14/08/2026 6:37 pm
TL;DR: A compromised Klue-Salesforce integration let the Icarus threat actor steal millions of CRM records, with one impacted organization losing about 13.9 million records and attacker activity spanning more than 24 hours across multiple victims, according to Obsidian Security. The incident shows that stale OAuth grants, excessive scopes, and weak integration monitoring turn trusted SaaS links into durable exfiltration paths.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “Technical Analysis of the Klue Attack: OAuth Abuse, Stale Integrations, and Salesforce Exfiltration”.
By the numbers:
- One impacted organization lost approximately 13.9 million records in the Klue-linked exfiltration campaign.
Key questions
Q: What breaks when Salesforce integrations keep standing OAuth access?
A: Standing OAuth access turns a third-party integration into a persistent trust bridge.
Q: Why do stale third-party OAuth grants increase SaaS breach impact?
A: Because the grant already carries trust, the attacker inherits legitimate access, normal authentication and often broad API reach.
Q: What are the signs that an internal OAuth application is being abused?
A: Common warning signs include newly added credentials on an internal app, generic or suspicious app names such as oAuth or app, unusual mail-related scopes, and running locations that do not match normal organizational patterns.
Practitioner guidance
- Inventory every Salesforce OAuth app Map each connected app to its owner, authoriser, scopes, last-use date and business purpose so stale grants can be identified before they become dormant access paths.
- Review and reduce OAuth scopes Remove unnecessary read, write and admin capabilities from third-party integrations, especially where the app can change code, query broad objects or persist access without re-consent.
- Baseline integration behaviour Track normal source IP ranges, user agents, API versions and query patterns for each trusted integration so deviations can be detected as soon as they appear.
Bottom line: A compromised SaaS integration can turn approved OAuth access into a high-volume exfiltration path without exploiting the underlying platform.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:43 pm
Stale OAuth consent is a governance asset with an expiry problem: once third-party access outlives the business use case, it becomes a latent attack path rather than an integration convenience. Obsidian’s analysis shows that the compromise was not purely about token theft, but about a privileged grant that remained usable long enough to matter. Practitioners should treat consent age, scope drift and owner drift as first-class risk indicators.
A few things that frame the scale:
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: When should teams revoke a third-party SaaS integration?
A: Revoke it when the app no longer has a clear business owner, when its permissions exceed the use case, when it was added outside approved governance, or when its behaviour changes in ways you cannot explain. If you cannot justify the access continuously, the safest answer is to remove it.
👉 Read our full editorial: Klue OAuth abuse shows how stale integrations expand SaaS blast radius