Salesforce Disables Klue Battlecards Integration After OAuth Token Theft Drains CRM Data From Customers Including Huntress
Attackers abused a compromised legacy Klue credential to mint Salesforce OAuth tokens and pull CRM records over roughly 24 hours. Salesforce disabled the Battlecards app on June 17.
Overview
Salesforce has disabled the integration for Klue, a competitive-intelligence platform whose Battlecards app syncs sales data with customer CRM systems, after attackers used stolen OAuth tokens to siphon CRM records from connected organizations. Salesforce posted the status update on June 17, 2026, stating that it had “disabled the connection between the Klue Battlecards app … as part of our response to a recent security incident,” according to Salesforce Ben.
The incident is the latest in a run of attacks that abuse third-party OAuth integrations rather than any flaw in Salesforce’s own platform. Salesforce emphasized that “this issue is limited to Klue’s app connection and does not arise from a vulnerability within the Salesforce platform,” per Salesforce Ben.
What We Know
Klue publicly confirmed the breach. In a statement reported by BankInfoSecurity, Klue CEO Jason Smith said “an attacker gained access through a compromised legacy credential associated with an integration service.” Smith added that “the attacker used that access to obtain OAuth tokens used to connect Klue with certain third-party platforms, including Salesforce, and subsequently accessed data within a number of connected customer environments,” according to BankInfoSecurity.
The activity was first detected by threat-research firm ReliaQuest, which observed that the attacker “authenticated to targets’ Klue integration service accounts, generated OAuth tokens, and ran what appear to be automated scripts to pull large volumes of CRM records,” as reported by ReliaQuest. The scripts queried Salesforce’s REST API using two endpoints — /services/data/v59.0/sobjects for enumeration and /services/data/v59.0/query for extraction — and used Python-urllib user-agent strings while paginating results through the QueryMore cursor, according to ReliaQuest.
The extraction ran over roughly 24 hours, including “a concentrated burst of nearly a thousand queries in 15 minutes” and “sustained extraction windows lasting over 6 hours,” per ReliaQuest. The firm assessed that “the volume and pacing point to bulk data retrieval, not routine integration traffic,” as quoted by GovInfoSecurity.
Klue says it detected unauthorized activity on June 12 and publicly confirmed the incident on June 19, according to BankInfoSecurity. Smith said the company “immediately took steps to contain the activity, including revoking affected credentials and tokens, removing unauthorized code, disabling potentially impacted integrations,” per BankInfoSecurity. Klue suspended integrations with Salesforce, Chorus, Clari, Gong, Google Drive, HubSpot, SharePoint, the Slack app and Zoom, BankInfoSecurity reported.
Cybersecurity company Huntress was confirmed as one of the affected customers, according to BleepingComputer. Huntress’s own assessment said the stolen data “includes business contacts, price quotes and other sales-related data and messaging” and that “no threat data, passwords, payment card information or engineering data” was compromised, as reported by GovInfoSecurity.
What We Don’t Know
Attribution remains unresolved. ReliaQuest stated there is “currently not enough evidence to attribute this activity to ShinyHunters or to rule the group out,” and noted the campaign resembles prior incidents by ShinyHunters and the threat cluster UNC6395, as reported by ReliaQuest. Cyber Security News reported that the tooling differs from UNC6395’s known patterns: that cluster previously used python-requests, the Salesforce CLI and Tor infrastructure, whereas this activity used a generic Python-urllib agent and data-center hosting. Separately, BleepingComputer linked the breach to a newer extortion actor it identified as Icarus, which it reported has been active since around April 2026 and listed victims on a darknet leak site, though ReliaQuest said it found no evidence confirming involvement by any group of that name.
The total number of affected Klue customers and the volume of records taken have not been quantified publicly. The full list of organizations impacted is also not confirmed, beyond the security firms that have disclosed their own exposure.
Analysis
The Klue incident follows a now-familiar pattern in which attackers target the OAuth trust relationships between SaaS platforms rather than the platforms themselves. Salesforce Ben noted parallels to the 2025 Salesloft Drift and Gainsight breaches, both OAuth-abuse campaigns against Salesforce customers. A single compromised credential inside a connected vendor can yield long-lived tokens that bypass multi-factor authentication and inherit the integration’s data access, turning one supplier’s lapse into a breach across that supplier’s entire customer base.