Icarus: The Extortion Group Behind the Klue–Salesforce Supply Chain Breach

What Is Happening?

Icarus is a data-theft and extortion group that has emerged as the actor behind one of 2026's most significant SaaS supply chain incidents. Their entry point was Klue, a competitive-intelligence platform used by sales and marketing teams across the technology industry. By compromising Klue's backend integration infrastructure, Icarus was able to harvest the OAuth tokens that Klue's customers use to connect the platform to their CRM environments, then use those tokens to walk directly into customer data.

A key clarification up front: Icarus is not a standard ransomware group. They do not encrypt files using software or malware. Their business model is pure data theft followed by extortion. They steal the data, threaten to publish it, and pressure victims into paying for silence. This is the same playbook used by groups like ShinyHunters, and it is becoming increasingly common as cloud integrations multiply the attack surface available to a single compromised vendor.

Who Is Icarus?

Icarus is a previously unknown group that, according to incident responders at Huntress, has been active since at least April 28, 2026. Before the Klue campaign, the group had listed two earlier victims on its dark-web data leak site, with stolen data hosted via the file-sharing service gofile[.]io. Several characteristics distinguish the group:

Communication via Session

Rather than traditional email-only extortion or dark-web forums, Icarus directs victims to negotiate through the privacy-focused Session messenger application. This move is designed to limit investigators' ability to monitor their communications.

Selective leak-site pressure

Icarus runs a Tor-based data leak site where it names victims and applies public pressure, but has been observed listing victims without supplying working download links. using the threat of publication as leverage rather than releasing data immediately.

Language designed to minimise

Leak-site copy described stolen data as "borrowed" rather than stolen, a framing choice that suggests an attempt to reduce the perceived severity of their actions.

Russian-linked infrastructure

The IP address hosting Icarus's leak content resolves to an autonomous system registered to a Russian hosting entity with a documented history of bulletproof hosting.

OAuth-abuse tradecraft overlap

The technique used in this incident closely mirrors the approach behind the 2025 Salesloft Drift and Gainsight incidents linked to ShinyHunters and the threat cluster UNC6395. Researchers have not yet formally attributed Icarus to either group.

Operational immaturity

Investigators observed at least one operator using the handle "mr bean" in extortion messages and noted the group corrected a messaging error mid-campaign. These are indicators of a relatively young operation still refining its tradecraft.

How the Attack Unfolded

Icarus's entry point into Klue was not a zero-day vulnerability, it was a long-forgotten credential. According to Klue's CEO and multiple incident response teams, the attacker used a dormant legacy credential tied to a third-party integration Klue had built years earlier and subsequently abandoned, but never formally deactivated. This is the kind of exposure that accumulates silently as organisations grow and integrations are added without a corresponding offboarding process.

Once inside Klue's integration infrastructure, the attacker moved methodically:

Backend infiltration

Gained access to Klue's backend integration layer, which sits between Klue and its customers' connected SaaS environments.

Token harvesting

Pushed unauthorised code specifically designed to harvest the OAuth tokens and refresh tokens that Klue's customers use to grant the platform access to platforms like Salesforce, Gong, HubSpot, and others.

Credential abuse

Used those stolen tokens to authenticate directly into customers' connected environments, bypassing the need for usernames or passwords entirely.

Mass data extraction

Ran automated Python-based scripts against the Salesforce REST API for roughly 24 continuous hours, pulling bulk CRM data in a pattern that stood out clearly from normal integration traffic.

Klue detected the anomalous activity around June 11–12, 2026, and responded by disabling integrations with Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack. Salesforce separately disabled Klue's "Battlecards" connector platform-wide while the investigation proceeded.

Who Was Affected?

As of this alert, 15 or more organisations have been confirmed or strongly linked to the breach. The victim list is notable for how heavily it skews toward the cybersecurity industry itself. This is a reminder that security vendors are high-value targets precisely because of the sensitive data their customers entrust to them:

Confirmed victims

Huntress, Recorded Future, BeyondTrust, LastPass, HackerOne, Insurity, Jamf, OneTrust, Snyk, Sprout Social, Tanium, 8x8, Pendo, and Klue itself.

Additional targets

Icarus's leak site separately named a Swiss AI communications firm and reportedly listed additional unnamed victims before the site went offline.

True scope

Huntress has cautioned that the true victim count is likely higher, with further disclosures expected as affected Klue customers complete their own investigations.

What Data Was Taken?

The pattern across disclosures from affected organisations is consistent: the stolen data is CRM and sales-related business data, not core product, source code, or infrastructure credentials. Typical exposure included:

• Business contact details; names, job titles, email addresses, phone numbers, and mailing addresses.
• Sales communications, pipeline opportunity notes, and price quotes.
• Subscription and pricing details, as well as product usage data.
• Support case records, in some instances.

Affected organisations have consistently confirmed that passwords, payment card data, customer vaults, threat intelligence feeds, and product telemetry were not compromised and exposure was limited to systems reachable through the Klue integration. That said, sales and contact data is ideal fuel for convincing follow-on phishing campaigns, invoice fraud, and business email compromise targeting customers and partners.

Extortion Tactics

Beyond the leak-site pressure, Icarus directly contacted employees at affected organisations via email. The messages carried subject lines like "top secret email" and gave recipients as little as 48 hours to initiate contact through Session before data would be published.

Critically, these extortion emails were sent from the real, hijacked mail servers of an unrelated Australian retail group. This means the messages pass standard email authentication checks, SPF and DMARC validation succeeds because the sending server is legitimate, even though the content is fraudulent. Filtering or dismissing these messages based on authentication signals alone is not reliable.

Known Indicators of Compromise

What You Should Do

1. Revoke and rotate all OAuth tokens linked to Klue

   A password reset is not sufficient. OAuth access tokens and refresh tokens must be explicitly revoked at the authorisation server level for every platform Klue was connected to, including Salesforce, HubSpot, Gong, SharePoint, Google Drive, Zoom, Slack, Chorus, and Clari.
2. Terminate active sessions, not just tokens

   Revoke all active sessions on affected services for any account that was accessible through the Klue integration. Active sessions established using stolen tokens remain valid even after the token itself is rotated, unless explicitly invalidated.
3. Audit every third-party OAuth integration on your CRM

   Enumerate every application with OAuth access to Salesforce and other connected platforms. Remove any integration that is no longer in active use. Apply least-privilege scoping to everything that remains, dormant, over-permissioned integrations are exactly what made this attack possible.
4. Review Salesforce and CRM API logs for anomalous activity

   Look for unusual query volume, bulk export patterns, or the specific IP addresses and user-agents listed in the IOC table above. The attacker ran automated Python scripts against the Salesforce REST API for approximately 24 hours, this traffic pattern should stand out clearly from normal integration activity.
5. Search for extortion emails and preserve them

   Search email and spam folders across your organisation for messages referencing Klue, the subject line "top secret email," or the domains listed in the IOC table. Preserve any matches for forensic purposes. Do not delete them and do not reply independently of your incident response team.
6. Do not pay or engage with the threat actor directly

   If you receive extortion contact, route it immediately through your incident response team, legal counsel, and law enforcement. Direct engagement without legal oversight typically worsens outcomes and may create additional legal exposure.
7. Do not download or open leaked data from dark-web sites

   Leak archives circulated via Icarus's site or gofile.io should not be opened. Archives linked to extortion campaigns frequently contain embedded malware targeting the curious. Confirm your specific exposure through your IR team and official Klue communications, not by downloading attacker-controlled files.
8. Alert sales and customer-facing teams to follow-on social engineering

   Stolen CRM and contact data is ideal material for targeted phishing, invoice fraud, and business email compromise. Brief your sales, finance, and customer success teams now. The stolen data gives attackers the context needed to craft highly convincing impersonation attempts targeting your customers and partners.
9. Restrict integration accounts to known IP ranges

   Where your SaaS platforms support it, limit OAuth integration access to authorised IP address ranges. This does not prevent all attacks, but it substantially reduces the blast radius of future credential or token theft.
10. Contact Klue directly if you haven't confirmed your exposure

    If you are a current or former Klue customer and haven't received specific breach notification, contact Klue's security team directly to request your incident details. Do not wait for a general public notice, ask for your specific exposure now.