Salesforce Cuts Klue Integration After OAuth Token Abuse Drains Customer CRM Data

Salesforce has disabled the Klue Battlecards application integration within its platform following a security incident at Klue, a competitive intelligence company, in which threat actors exploited compromised OAuth tokens to extract bulk customer CRM records through the integration's API access. The incident, which Salesforce confirmed in an advisory published on 19 June 2026, occurred on 11 June 2026 and is not the

"Salesforce took this action because our security teams recently detected unusual activity involving the app that may have resulted in unauthorised access to a subset of customer data via the app's connection to Salesforce," the company stated. Organisations that used Klue's Battlecards integration will be unable to connect to Salesforce via the app until further notice.

How the attack unfolded

ReliaQuest researchers, who documented the technical details of the intrusion, identified that threat actors authenticated through compromised Klue integration service accounts and generated OAuth tokens, which were then used to run automated Python scripts against Salesforce's REST API. The scripts are identifiable by their Python-urllib user-agent strings.

The exfiltration began with catalogue enumeration via the Salesforce objects endpoint, followed by looped REST API queries against the query endpoint with results paginated through the QueryMore cursor. The first phase was a slow, sustained pull lasting approximately 24 hours, designed to blend with legitimate integration traffic. The second phase shifted to a concentrated burst of nearly 1,000 queries within a 15-minute window, suggesting either time pressure or a targeted pivot to high-value records.

In a separate environment analysed by ReliaQuest, extraction was maintained for a six-hour period. The extortion group Icarus subsequently confirmed it had exfiltrated data from Klue customers including cybersecurity company Huntress, whose data included records held in its Salesforce account.

The third-party OAuth attack pattern

This incident is the third in a series of OAuth-based attacks against Salesforce-connected integrations documented across 2025 and 2026. In June 2025, threat group ShinyHunters used voice phishing to trick employees into authorising malicious connected apps before extracting Salesforce data at scale. In August 2025, the cluster tracked as UNC6395 compromised OAuth refresh tokens from the Salesloft Drift integration, querying Salesforce across hundreds of customer organisations.

The defining characteristic across all three incidents is consistent: attackers gain access not by exploiting the Salesforce platform itself but by compromising a trusted third-party integration that already holds persistent, broadly scoped API access. Integration service accounts are frequently granted the permissions needed for the integration to function at deployment and then never reviewed, rotated, or scoped down. They become standing access privileges that receive far less monitoring scrutiny than employee accounts.

ReliaQuest assessed that it is highly likely threat actors will continue targeting third-party Salesforce-connected integrations throughout the remainder of 2026.

What GCC Salesforce users must do now

Organisations across the UAE and Saudi Arabia that use Salesforce as their CRM should treat this incident as a prompt to audit their complete inventory of connected integrations. The specific actions are as follows.

Review all OAuth-connected app permissions in Salesforce Setup, specifically examining which integrations hold object-level read or export permissions across standard and custom objects containing customer or employee records. Revoke and rotate any credentials tied to third-party integrations as a precautionary measure, including OAuth tokens, refresh tokens, and client secrets.

Enable event monitoring and audit trail logging for REST API access if not already active. Look for anomalous query volumes, repeated QueryMore pagination, unfamiliar user-agent strings, and API access from IP addresses not associated with the integration vendor's known infrastructure.

Apply the principle of least privilege to all integration service accounts. An integration that requires read access to a single object type should not hold organisation-wide export permissions. Review and constrain the scope of each connected app to the minimum required for it to function.

GCC security teams should approach all third-party Salesforce integrations with the same governance rigour applied to privileged human accounts. The Klue incident demonstrates that a compromise at any point in the integration chain is sufficient to exfiltrate the entirety of what that integration can access.