A breach at market intelligence platform Klue allowed attackers to steal OAuth tokens linking Clue to customers&#x27; Salesforce environments, enabling quiet API-driven data extraction from firms including Huntress, Recorded Future, Tanium, and Jamf; Clue revoked tokens, removed the legacy integration credential involved, and engaged CrowdStrike as Icarus threatens extortion, echoing earlier Salesforce token-theft campaigns affecting nearly 1,000 companies. Researchers also detail AriStinger, a new botnet infecting 4,000+ end-of-life D-Link routers to scan, proxy, tunnel, execute commands, and hijack DNS, with many infections in South Korea and China. The episode covers federal cyberstalking charges against Anthony Belford for allegedly using fake accounts and AI-generated nude images, and ESET&#x27;s report that the &quot;Gentleman&quot; ransomware crew is developing modular EDR-killing tools to disable endpoint defenses. 00:00 Top Stories Teaser 00:29 Clue OAuth Token Breach 02:32 Salesforce Token Attack Trend 04:14 AryStinger Router Botnet 05:33 AI Deepfake Cyberstalking Case 07:50 Gentleman EDR Killer Arsenal 09:37 Wrap Up And Sign Off

Stolen OAuth Tokens Hit Security Firms, AryStinger Router Botnet Emerges, AI Deepfake Cyberstalking

Cybersecurity Today

# Full Transcript

**Podcast:** Cybersecurity Today

## Participants

- **David Shipley** (Cybersecurity Today)

## Transcript

A single stolen token leads to breaches at several major security firms. A new botnet turns abandoned routers into someone else's cyber weapon. A cyberstalker hides behind AI-generated fakes. And a ransomware crew builds a whole new arsenal to switch off endpoint defenses. This is Cybersecurity Today, and I'm your host, David Shipley. Let's get started.

Market intelligence platform Clue has confirmed a breach that let attackers steal the OAuth Tokens linking it to its customers' Salesforce environments. The extortion group Icarus has claimed responsibility. Here's how the attack unfolded.

Clue says an attacker got in through a compromised legacy credential, one tied to an integration service the company built, prototyped, and then abandoned. The credential for that system was also still live. From there, the attacker pivoted into Clue's infrastructure and grabbed the OAuth Tokens its customers used to connect Clue to Salesforce.

Then came the harvest. Using those stolen tokens, the attacker queried customer Salesforce environments directly. ReliaQuest watched automated Python scripts loop through Salesforce's API. In one case, nearly a thousand queries in 15 minutes. In another, a six-hour extraction window. Bulk CRM theft running quietly from a trusted connection.

No password, no password, no MFA prompt, no phished employee for this one. The attacker had the token. From Salesforce's view, that token is Clue. Access granted. Records pulled. The traffic came from infrastructure with no link to Clue's real environment. And nobody's alarms went off. The victim list includes cybersecurity firms.

Huntress, recorded future, recorded future, tanium, jam, as well as other firms like sprout social, gong, and insurity. Most report the same thing. Business contacts, sales records, and pricing taken from Salesforce with platforms and payment systems untouched. Thankfully, Clue has revoked the affected tokens, yanked the old system and credentials that started it, and brought in CrowdStrike, as well as notifying law enforcement.

Clue is demanding contact through the session. Clue is demanding. With the usual threat to leak the data. And if all of this feels oddly familiar, it should. Clue is just the latest hit in a year-long run of OAuth token attacks on the Salesforce ecosystem.

And the pattern barely changes. Last August, the crew tracked as UNC6395 stole tokens tied to the SalesLoft Drift chatbot and used them to raid more than 700 organizations' Salesforce environments, including Cloudflare, Google, Palo Alto Networks, and Zscaler. Then in November, Shiny Hunters ran that playbook again, this time through Gainsight,

reusing secrets stolen in the drift breach to issue refresh tokens for roughly 285 Salesforce instances. Together, the combined campaigns hit close to a thousand companies. Nobody broke into Salesforce. They ...

Stolen OAuth Tokens Hit Security Firms, AryStinger Router Botnet Emerges, AI Deepfake Cyberstalking

Transcript

Built for investment professionals

Every day you wait, your competitors are finding
edge in conversations you're not hearing.

Stolen OAuth Tokens Hit Security Firms, AryStinger Router Botnet Emerges, AI Deepfake Cyberstalking

Transcript

Built for investment professionals

Every day you wait, your competitors are findingedge in conversations you're not hearing.

Every day you wait, your competitors are finding
edge in conversations you're not hearing.