Notifications
Clear all
Topic starter
14/08/2026 6:37 pm
TL;DR: A compromised Klue-Salesforce integration let the Icarus threat actor steal millions of CRM records, with one impacted organization losing about 13.9 million records and attacker activity spanning more than 24 hours across multiple victims, according to Obsidian Security. The incident shows that stale OAuth grants, excessive scopes, and weak integration monitoring turn trusted SaaS links into durable exfiltration paths.
NHIMG editorial — based on content published by Obsidian Security covering the Klue OAuth supply chain breach: Technical Analysis of the Klue Attack: OAuth Abuse, Stale Integrations, and Salesforce Exfiltration
By the numbers:
- Across the impacted organizations, activity was spread over more than 24 hours and varied by source IP, timing, and scope.
Questions worth separating out
Q: What breaks when a third-party OAuth integration has stale access?
A: Stale OAuth access turns a trusted connector into a standing exfiltration path.
Q: Why do third-party SaaS integrations increase blast radius?
A: They increase blast radius because one trusted app can reach multiple systems, data stores, and secret locations at once.
Q: How can security teams tell when a trusted integration is being abused?
A: Look for drift from the approved behavioural baseline.
Practitioner guidance
- Inventory every high-value OAuth integration Build a current register of which apps can reach Salesforce and other crown-jewel SaaS platforms, who authorized them, what scopes they hold, and when they were last validated.
- Reduce delegated privilege to the minimum operational scope Review whether each integration truly needs metadata discovery, bulk export, admin-like write access, or code-change capability.
- Detect behavioural drift in trusted integrations Baseline source IP ranges, user agents, API versions, query volume, and query type for every approved integration.
What's in the full report
Obsidian Security's full post covers the operational detail this post intentionally leaves for the source:
- The incident timeline and the specific customer-by-customer deviations in source IP, user agent, and API version.
- The Salesforce query patterns, including Global Describe, SOQL extraction, and QueryMore pagination details.
- Obsidian's detection examples and how the telemetry mapped to the compromised integration behaviour.
- The remediation priorities for vendors and customers, including token rotation, scope reduction, and revocation workflows.
👉 Read Obsidian Security's analysis of the Klue OAuth breach and Salesforce exfiltration →
Stale OAuth integrations in Salesforce: where governance breaks down?
Explore further
14/08/2026 6:43 pm
Stale OAuth grants are now a primary NHI risk surface, not a secondary SaaS hygiene issue. This incident shows that delegated access can survive long after the business relationship or operational need has changed. When the token still has code-changing or data-export privileges, the integration becomes a standing path into crown-jewel SaaS systems. Practitioners should treat OAuth lifecycle governance as part of NHI control, not app administration.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Another finding from the same research shows that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a compliance and breach-investigation blind spot.
A question worth separating out:
Q: Who is accountable when a SaaS integration exposes customer data?
A: Accountability sits with the organisation that owns the delegated access path, even if the token originated from a third-party service. Security, application, and SaaS owners all need a defined revocation process and an incident playbook. If the integration can reach customer data, it must be governed like any other privileged identity.
👉 Read our full editorial: Klue OAuth abuse shows how stale integrations expand SaaS blast radius
