# Cybercrime Breaches Klue: Salesforce Data Impacted for Many Victims, including Huntress

Dormant Klue integration credential let attackers push token-stealing code, harvest customer OAuth tokens, and exfiltrate Salesforce CRM data across many orgs.

- Payout: Real-world hack
- Severity: high
- Program: Klue
- Analysis by: Huntress
- Disclosed: 2026-06-18
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/klue-breach-investigation
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-klue-breach-investigation
- Tags: area:web3 domain:cloud domain:web3 impact:data-leak impact:mass-exploit kind:incident platform:threat-intel sev:high tech:oauth technique:legacy-endpoint technique:source-review vuln:access-control vuln:auth-bypass vuln:secrets-leak

**Target:** Market intelligence platform backend integration service and downstream Salesforce/Gong OAuth-connected apps
**Root cause:** A long-disused but still-active credential, originally created by Klue to prototype an abandoned third-party integration, was never decommissioned. Attackers used it to access Klue's integration backend and push a code update that harvested customers' OAuth tokens.
**Steps:**
1. Obtain/leverage the dormant prototype integration credential still active in Klue's integration system.
2. Use it to remotely connect to Klue backend servers and execute commands (unusual network connections to attacker IPs observed June 11).
3. Push a code update to the integration service that collects OAuth tokens customers use to connect Klue to their systems.
4. Harvest OAuth tokens for Salesforce, Gong, and other integrations.
5. Use stolen tokens to query customer CRMs directly via REST API, e.g. `GET /services/data/v59.0/query/<STRING>` with User-Agent `Python-urllib/3.12`, `Python-urllib/3.14`, or `5238`.
6. Page through results with QueryMore (2,000-record API limit) to bulk-export Opportunity, Case, Task, Lead, Contact, Account, User, Contract, Event, Campaign objects.
7. Exfiltrate data and send extortion emails ('top secret email', 48-hour deadline) via compromised Australian retailer mail domains.
**How found:** Klue noticed anomalous behavior in an integration-connecting system on June 11 and unusual outbound network connections to attacker IPs the next day; Huntress confirmed downstream impact by pulling Salesforce/Gong query logs and spotting telltale User-Agents (5238, blank, Python-urllib) against the v59.0 query endpoint.
**Exploitation:** Attackers used the dormant credential to reach Klue's integration backend, deployed token-stealing code, then replayed harvested OAuth tokens against each customer's Salesforce/Gong APIs to bulk-query and exfiltrate CRM data, later extorting victims via Session Messenger and a leak site.
**Escalation:** One upstream compromise fanned out to many downstream Klue customers via their stored OAuth tokens, turning a single integration foothold into multi-org CRM data theft and extortion.
**Insight:** Audit for orphaned integration credentials and OAuth grants from abandoned prototypes; on the defender side, hunt connected-app API logs for bulk /services/data/vXX.0/query/ calls with scripting User-Agents and QueryMore paging as a token-replay exfil signal.

## Proof of concept (copied exactly from the original report)

**Salesforce REST API query endpoint abused for exfiltration**

```
Most (effectively all) of the malicious requests to SFDC target /services/data/v59.0/query/<STRING>  and nearly all have a User-Agent of 5238 or a blank value, though there are some outliers, such as these Python User-Agent strings used in nearly 900 of the queries (cumulative count on the left-hand side):

811 "Python-urllib/3.12"
58 "Python-urllib/3.14"
```

**Detection query for malicious v59.0 API usage**

```
event_name:ApiTotalUsage connected_app_name:* api_family:REST api_client_category:EXTERNAL_APPLICATION api_resource:*v59.0/query/*

The ApiTotalUsage event includes a client_ip field but does not include a user agent.

event_name:RestApi connected_app_id:* method:GET uri:/services/data/v59.0/query* message:Query*
```

**Threat actor querying all Event fields**

```
$ SELECT FIELDS(STANDARD) FROM Event

exception_message: fault=-1;
common.exception.ApiException: exceeded 100000 distinct who/what's
```