For more than a decade, enterprise cybersecurity strategies have focused on protecting endpoints, patching vulnerabilities and strengthening user authentication. These investments remain essential, but they no longer reflect where many of today’s most sophisticated attackers are concentrating their efforts. Increasingly, threat actors are targeting the trusted relationships that connect modern cloud applications.
Enterprise organizations now rely on hundreds of Software-as-a-Service (SaaS) platforms that exchange information through APIs, service accounts and OAuth authorizations. These integrations automate business processes, improve productivity and eliminate manual administration. They also create a growing web of machine identities that often possess privileged access to business-critical data.
Recent events involving competitive intelligence platform Klue illustrate how attackers have adapted to this reality. Rather than exploiting a vulnerability in Salesforce or compromising customer credentials, attackers allegedly obtained OAuth tokens used by a trusted third-party integration, allowing them to access customer CRM environments through legitimate application programming interfaces (APIs). For CISOs and IT managers, the incident demonstrates that modern supply chain risk increasingly revolves around trust rather than software vulnerabilities.
The implications extend well beyond a single vendor. Every organization that relies on interconnected cloud applications faces similar risks.
Identity Has Become the New Attack Surface
Traditional cyberattacks typically require adversaries to exploit software vulnerabilities, steal employee credentials or deploy malware onto endpoints. Identity-based attacks follow a different model.
Instead of breaking into an environment, attackers inherit existing trust.
OAuth has become the authentication standard for cloud applications because it allows software platforms to securely access services without requiring passwords. Organizations routinely authorize applications to read customer data, synchronize records, automate workflows and perform administrative tasks on behalf of users.
Once these trust relationships are established, the applications often operate continuously with little human oversight.
This creates an attractive opportunity for attackers.
If threat actors can compromise the credentials or tokens associated with a trusted integration, they may gain legitimate access to enterprise data without triggering many traditional security controls. Security platforms designed to identify suspicious user logins or malware may see nothing unusual because the requests originate from an authorized application using approved APIs.
The result is a fundamentally different attack model that exploits trust instead of technology.
Lessons from the Klue Incident
According to Klue’s public investigation, attackers compromised a legacy credential associated with one of the company’s integration services before obtaining OAuth tokens used to connect with customer Salesforce environments.
CEO Jason Smith explained the sequence of events in the company’s incident update.
“The attacker gained access through a compromised legacy credential associated with an integration service. The attacker used that access to obtain OAuth tokens used to connect Klue with certain third-party platforms, including Salesforce.”
Importantly, investigators found no evidence that Salesforce itself had been compromised. Instead, the attackers abused a trusted relationship between applications.
Several organizations later confirmed that Salesforce data had been accessed through the affected integration. Public reporting indicates that the information primarily consisted of CRM records, customer contacts, sales communications and related business intelligence rather than production systems or customer-facing infrastructure.
Although the technical details remain specific to this incident, the broader lesson applies to every enterprise. Modern organizations increasingly depend on interconnected SaaS ecosystems where a compromise involving one trusted integration can create downstream exposure across multiple customers.
This is precisely why third-party risk assessments can no longer focus exclusively on vendor questionnaires and compliance certifications. Organizations must also understand how vendors authenticate, manage machine identities and protect integration credentials throughout their lifecycle.
The Emergence of Icarus
Responsibility for the attack has been claimed by the emerging cyber extortion group known as Icarus, a relatively new threat actor that appears to prioritize large-scale data theft over traditional ransomware deployment.
Unlike conventional ransomware operators that seek to encrypt business systems, groups such as Icarus increasingly focus on stealing valuable information before attempting extortion. Once sensitive data has been exfiltrated, organizations face difficult decisions involving disclosure obligations, reputational damage and potential regulatory consequences.
Researchers linked Icarus to the Klue incident through multiple indicators, including infrastructure associated with the group’s leak site and extortion communications reportedly sent to affected organizations.
This reflects a broader evolution across the cybercriminal ecosystem.
Cloud-first enterprises often maintain resilient backup strategies that reduce the operational impact of ransomware. Data theft, however, remains difficult to mitigate after the information has already left the environment. For attackers, compromising a trusted SaaS provider also offers far greater efficiency than targeting dozens of organizations individually.
Rather than breaching every victim separately, a single trusted integration may provide access to multiple enterprise environments.
Why SaaS Governance Requires a New Approach
Most organizations have mature processes for governing privileged human accounts. Administrative users receive additional authentication controls, privileged access management, regular access reviews and continuous monitoring.
Machine identities rarely receive the same attention.
Service accounts, API keys and OAuth authorizations often remain active for years without meaningful review. Business applications accumulate permissions as organizations deploy new services, integrate additional platforms and automate increasingly complex workflows.
Over time, these identities become highly privileged while remaining largely invisible to security operations teams.
The Klue incident highlights why this approach is no longer sustainable.
Every connected application should be viewed as another privileged identity operating within the enterprise. Like human administrators, these identities require governance, monitoring, lifecycle management and continuous risk assessment.
Organizations adopting Identity Threat Detection and Response (ITDR), SaaS Security Posture Management (SSPM) and Cloud Infrastructure Entitlement Management (CIEM) capabilities are increasingly recognizing that machine identities represent one of the fastest-growing areas of enterprise risk.
Beyond Vendor Risk Management
The incident also challenges traditional approaches to third-party risk management.
Many organizations evaluate suppliers during procurement before repeating assessments annually. While certifications, penetration testing reports and compliance audits remain valuable, they rarely provide ongoing visibility into how vendors manage integration credentials or monitor privileged application activity.
Third-party risk programs should increasingly answer operational questions rather than simply verifying compliance.
Security leaders should ask:
- How many third-party applications currently possess privileged access to critical business systems?
- Are OAuth authorizations reviewed regularly and removed when no longer required?
- Can security teams detect abnormal API behavior originating from trusted applications?
- Are machine identities included within identity governance and privileged access management programs?
- Does vendor monitoring continue throughout the relationship rather than ending after onboarding?
These questions provide a far more accurate picture of enterprise exposure than traditional compliance checklists alone.
Building Resilience Against Integration-Based Attacks
Reducing the likelihood of similar incidents requires organizations to expand their identity strategies beyond employees and administrators.
Effective programs should include:
- Continuous auditing of SaaS integrations, enforcement of least-privilege permissions for service accounts, routine credential rotation, comprehensive OAuth governance and monitoring for unusual API activity.
- Integration of machine identities into threat hunting, security operations, incident response planning and third-party risk management so that trusted applications receive the same oversight as privileged users.
These measures significantly reduce the opportunity for attackers to exploit inherited trust within interconnected cloud environments.
Trust Must Become a Security Control
According to Klue, investigators found no evidence that customer content stored directly within the Klue platform itself had been compromised during the incident. As CEO Jason Smith noted:
“Based on our investigation to date, the incident was limited to the affected third-party platforms, and there is no evidence that customer content stored within the Klue platform was impacted.”
While that finding helped define the scope of the incident, the larger lesson extends well beyond any individual organization.
Enterprise security is entering an era where the greatest risks often emerge not from software vulnerabilities, but from the relationships established between trusted applications. Every API connection, OAuth authorization and service account effectively becomes another privileged identity inside the organization.
For CISOs and IT managers, the challenge is no longer simply preventing unauthorized access. It is understanding which identities the business trusts, continuously validating whether that trust remains appropriate and ensuring every machine identity is governed with the same discipline applied to human users.
In an increasingly interconnected cloud ecosystem, trust itself has become one of the most valuable assets to protect, and one of the most attractive targets for attackers.