Hackers Exploit Klue Integration to Steal Salesforce CRM Data Using OAuth Tokens

Hackers are actively exploiting a compromised Klue Battlecards integration to extract sensitive Salesforce CRM data by abusing OAuth tokens, according to new research published by ReliaQuest on June 17, 2026.

This campaign highlights a growing trend in which attackers use trusted third-party SaaS integrations as gateways into enterprise environments, effectively bypassing traditional security measures that primarily focus on user accounts and endpoint activity.

Hackers Exploit Klue Integration

ReliaQuest researchers found that threat actors accessed Klue integration service accounts and generated valid OAuth tokens, which were then used to authenticate directly with Salesforce environments.

Using automated scripts, identifiable through Python-urllib user-agent strings, the attackers methodically queried Salesforce’s REST API endpoints, including /services/data/v59.0/sobjects and /query, to enumerate and extract large volumes of CRM data.

This activity persisted for extended periods; in some cases, it lasted nearly 24 hours, with bursts of high-frequency queries reaching almost 1,000 requests within a 15-minute window. This pattern indicates a shift from discreet data collection to rapid bulk extraction, likely driven by operational urgency or the targeting of specific datasets.

The stolen data potentially includes account records, customer contact information, sales pipeline details, and pricing intelligence, depending on the scope and permissions of the compromised integration.

ReliaQuest confirmed data exfiltration but noted that the full scale of impacted records and the attacker’s ultimate objective remain under investigation. Notably, no extortion demands or public data leaks have been observed at this stage.

This incident closely mirrors a broader wave of Salesforce-focused OAuth abuse campaigns observed throughout 2025 and 2026. Previous attacks involving platforms such as Salesloft, Drift, and Gainsight were attributed to threat groups including ShinyHunters and UNC6395, both known for targeting SaaS integrations to harvest sensitive enterprise data.

However, researchers caution that attribution in this case remains inconclusive, as the tooling and infrastructure, such as the use of generic Python libraries and data center-hosted IPs, differ from earlier campaigns that leveraged tools like python-requests or Tor-based routing.

A key factor enabling this attack is the inherent trust placed in third-party integrations. These integrations operate as non-human identities with persistent OAuth access and often broad permissions.

Yet, they are rarely monitored with the same rigor as user accounts. As a result, malicious activity conducted through these channels can blend in with legitimate API traffic, allowing attackers to operate undetected for extended periods.

In response to the incident, Salesforce has turned off the Klue Battlecards integration across customer environments as a precautionary measure, stating that the issue stems from the third-party application rather than a vulnerability within Salesforce itself.

Organizations using Klue or similar integrations are strongly advised to immediately revoke and rotate all associated credentials, including OAuth access and refresh tokens, client secrets, and service account passwords.

Security teams should also conduct thorough reviews of Salesforce API logs to identify anomalies such as excessive query volumes, repeated pagination requests, unusual user-agent strings, and access from unfamiliar IP addresses.

Implementing strict IP allowlisting for integration accounts and limiting API access to trusted infrastructure can further reduce exposure.

ReliaQuest emphasized that, as attackers increasingly exploit identity and API layers rather than deploy malware, organizations must expand their defensive strategies to include continuous monitoring of SaaS integrations.

With OAuth abuse proving to be both scalable and effective, similar attacks targeting Salesforce-connected ecosystems are expected to persist throughout 2026.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.