Critical Klue Vulnerability Exposed Salesforce CRM Data

Key Takeaways

• Threat actors exploited a vulnerability in the Klue Battlecards integration to exfiltrate sensitive CRM data from Salesforce instances.
• The attack leveraged compromised Klue service account credentials and OAuth tokens, not a direct vulnerability in Salesforce itself.
• Data exfiltration occurred in two phases: a slow, sustained extraction over 24 hours followed by a rapid burst of queries.
• Salesforce has disabled the Klue Battlecards app’s connection, and organizations are urged to revoke credentials and audit API logs.
• This incident highlights the ongoing risk of OAuth abuse and the compromise of third-party SaaS integrations in enterprise environments.

Third-Party Integration Vulnerability Exposes Salesforce CRM Data

Cybersecurity researchers have uncovered a significant data exfiltration campaign where threat actors exploited a trusted third-party SaaS integration to silently harvest extensive customer relationship management (CRM) data from enterprise Salesforce environments. This incident underscores a growing trend of OAuth-abuse attacks targeting the Salesforce ecosystem.

Analysts at ReliaQuest identified attackers compromising a Klue Battlecards integration, a platform designed for competitive intelligence that syncs battlecard and win/loss data with Salesforce. Through this compromised integration, large volumes of sensitive CRM data were systematically stolen from affected organizations.

Salesforce Responds to Klue Integration Compromise

In response to the discovery, Salesforce has taken immediate action, disabling the Klue Battlecards app’s connection to its platform. The company stated that unusual activity “may have resulted in unauthorized access to a subset of customer data” and confirmed that the issue stems from a compromise of Klue’s integration service account credentials, not a vulnerability within Salesforce’s own platform.

The attackers gained access by authenticating with these compromised Klue integration service accounts. They then generated OAuth tokens and deployed automated Python scripts, identifiable by unique Python-urllib user-agent strings, to methodically extract CRM records using Salesforce’s REST API.

Attack Methodology: Two Phases of Data Exfiltration

ReliaQuest’s investigation revealed a sophisticated, two-phase exfiltration pattern:

• Phase 1 – Slow Extraction: Initially, threat actors enumerated the target organization’s object catalog by querying GET /services/data/v59.0/sobjects. This was followed by sustained, looped REST API queries over nearly 24 hours, paginating results via the QueryMore cursor. This method was designed to mimic legitimate integration traffic, allowing the activity to remain undetected for an extended period.
• Phase 2 – Burst Extraction: In certain instances, the attackers shifted tactics, prioritizing speed over stealth. In one observed environment, nearly 1,000 queries were executed within a 15-minute window, suggesting either time constraints or a targeted focus on high-value records. Another incident involved continuous data extraction that lasted over six hours.

The specific CRM data accessible to the attackers varied based on the permissions configured for each organization’s Klue integration, but could include critical information such as account records, contact details, deal outcomes, and pricing data.

Echoes of Previous OAuth Abuse Campaigns

ReliaQuest researchers noted that the attack methodology bears a strong resemblance to tactics employed by well-known threat clusters, ShinyHunters and UNC6395, both implicated in high-profile Salesforce OAuth-abuse incidents throughout 2025 and 2026.

• In June 2025, ShinyHunters utilized voice phishing to trick employees into authorizing malicious connected applications, subsequently extracting large volumes of Salesforce data for extortion purposes.
• August 2025 saw UNC6395 compromise OAuth refresh tokens from the Salesloft Drift integration, leading to the querying of Salesforce data across hundreds of organizations—an incident that closely parallels the current Klue compromise.

Despite these similarities, definitive attribution remains unconfirmed. Key distinctions include UNC6395’s prior use of python-requests, Salesforce-CLI, and Tor infrastructure, whereas the current activity employed a generic Python-urllib agent and data-center hosting. As of this report, no extortion demands or public data leaks have been observed.

Structural Vulnerability in Third-Party Integrations

This incident highlights a fundamental structural vulnerability inherent in many third-party SaaS integrations. These integrations often function as non-human identities, possessing persistent and frequently broad API access to sensitive organizational data. Because they authenticate with valid credentials, their malicious activity often bypasses standard behavioral alerts typically triggered by user account compromises. This allows automated query loops, like the 24-hour extraction observed, to proceed undetected from a “trusted” account.

ReliaQuest’s GreyMatter platform played a crucial role in correlating the OAuth token refresh, sustained API query spikes, and burst extraction activity, assembling a comprehensive picture of the intrusion. This demonstrates the critical importance of API-layer visibility, especially in environments heavily reliant on integrations.

What You Should Do

Organizations utilizing Klue or any other Salesforce-connected integration must take immediate action to mitigate potential risks:

• Revoke and Rotate Credentials: Immediately revoke and rotate all associated credentials, including service-account passwords, OAuth refresh tokens, client secrets, and active OAuth grants. Revoking the refresh token is paramount, as it terminates persistent access.
• Audit Salesforce REST API Logs: Thoroughly review Salesforce REST API logs for any unusual query volumes, repeated pagination, the presence of Python-urllib user-agents, and access originating from unknown or suspicious IP ranges.
• Enforce IP Allowlisting: Implement strict IP allowlisting for connected apps and SIEM/SOAR API access, restricting access to only approved infrastructure. Configure alerts for any requests originating from out-of-scope IP addresses.

ReliaQuest assesses a high likelihood that threat actors will continue to target Salesforce-connected third-party integrations throughout 2026, cautioning that the OAuth-abuse playbook is “repeatable, effective, and now widely adopted.”

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.