Vendor
high
advisory
Klue Security Incident Leads to Recorded Future Salesforce Data Compromise
3 TTPsA third-party marketing vendor, Klue, experienced unauthorized access to its integration layer, which connects to other SaaS platforms like Salesforce, leading to the compromise of an OAuth token and subsequent unauthorized access to Recorded Future's Salesforce account, where business data fields including customer contact names, email addresses, and potentially business contract information were accessed.
Klue +1
data-breach
supply-chain
cloud-security
saas-security
oauth
3t
high
threat
ShinyHunters OAuth Abuse Targeting SaaS Applications
6 TTPsShinyHunters, and related threat actor Storm-3138, conducted campaigns between mid-2025 and mid-2026 by employing voice phishing, supply chain compromise, and misconfigured guest access to abuse trusted OAuth relationships in SaaS applications like Salesforce, leading to unauthorized access, data exfiltration, and persistence.
Salesforce +4
ShinyHunters
oauth-abuse
saas
supply-chain
vishing
data-exfiltration
persistence
cloud
6t