Target/Victims: Klue, LastPass, and others. Delivery Vector: Compromised integration service credentials from 2022. Key Capabilities: Unauthorized Salesforce CRM access via stolen OAuth tokens. Threat Actor: Icarus ransomware group (Suspected). Source: Klue, LastPass, and affected...
The market intelligence platform Klue has confirmed a breach of part of its integration infrastructure. Attackers obtained OAuth tokens, the digital keys that grant access between services. With those keys, they slipped into the...
The escalating saga surrounding the Salesforce ecosystem data breach has taken a new turn after the group ShinyHunters publicly claimed responsibility for its role in the incident. The events, unfolding over several months, have...
The investigation into the corporate data breach affecting Salesforce customers continues to widen. The company is now examining how third-party Gainsight applications became the channel through which unauthorized parties gained access to client information....
In the night of October 12, the cybercriminal collective Scattered Lapsus$ Hunters (SLSH) — notorious for its high-profile data breaches and aggressive tactics — announced that it would cease operations until 2026, following the...
BreachForums, a website long associated with the publication of stolen data, has once again gone offline. This time, its domain displays an official seizure banner featuring the logos of the U.S. Federal Bureau of...
The Scattered Lapsus$ Hunters group has resurfaced — this time with a bizarre and unorthodox extortion tactic. The cybercriminals announced a bounty of $10 in cryptocurrency to anyone willing to take part in a...
A group calling itself Scattered LAPSUS$ Hunters has reemerged after months of silence and multiple arrests of its alleged members. On a newly launched leak site, the attackers published a list of approximately forty...
Salesloft has announced the restoration of its integration with Salesforce following the incident linked to the Drift platform and its associated technologies. As of the evening of September 7, 2025, synchronization between Salesloft and...
A large-scale theft of authentication tokens from Salesloft, developer of the corporate chatbot platform, has triggered a chain reaction of threats across digital infrastructure worldwide. According to a warning from Google, the breach affects...
Drift has disclosed details of a security incident involving its Salesforce integration. Between August 8 and August 18, 2025, an unknown actor exploited OAuth credentials to extract data from customer Salesforce instances. According to...
The hacker groups ShinyHunters and Scattered Spider, once operating independently, now appear to have joined forces in a coordinated campaign to extort data from Salesforce’s corporate clients. As noted by ReliaQuest, ShinyHunters has undergone...
