A Single Dormant Credential Turned Into a Cross-Industry SaaS Breach

Klue OAuth breach spreads via Salesforce, victim list grows. Klue confirmed unauthorized activity discovered June 12 after attackers used a long-dormant legacy API credential to reach its integration backend, push malicious code, and harvest the OAuth tokens customers used to connect Klue to Salesforce, HubSpot, Slack, Gong, Google Drive and other platforms. The newly surfaced “Icarus” extortion group has publicly claimed responsibility; named victims who have since disclosed include Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity, with most stressing that only their Salesforce data — sales contacts, pricing, opportunity notes — was taken, not their own platforms. Klue has revoked tokens, pulled the integrations, and engaged CrowdStrike for incident response.

New “Prinz Eugen” ransomware runs quiet. Researchers detail a freshly built, Go-based encryptor using ChaCha20-Poly1305 encryption and Argon2id-derived keys that prioritizes the most recently modified files and drops no ransom note or wallpaper change — a deliberate move to shrink the forensic footprint and delay detection of the extortion stage. Operators favor hands-on-keyboard tradecraft using legitimate remote-management and living-off-the-land tools, with initial access likely through stolen RDP credentials. It is not yet operating as ransomware-as-a-service; at least five victims have been identified, including one that refused a 1 BTC demand.

Conti loader developer pleads guilty. Oleksii Lytvynenko admitted on June 22 to helping develop a loader for the Conti ransomware operation — a reminder that the law-enforcement tail on the major 2021-2022 ransomware brands is still landing convictions.

So what: Today’s through-line is the trust boundary nobody drew — a third party’s OAuth token, a plugin’s leaked connector keys, a sidecar service most operators forgot was network-reachable. None of these are caught by hardening your own perimeter; they’re caught by visibility across identity, SaaS, and integration telemetry.

Gravity SMTP WordPress flaw under mass exploitation. CVE-2026-4020 (CVSS 5.3) is a broken permission callback in the Gravity SMTP plugin, installed on roughly 100,000 sites, that returns “true” for every request — exposing live API keys and OAuth tokens for connected mail services including Amazon SES, Google, Mailjet, Resend and Zoho to any unauthenticated HTTP call. It was patched in version 2.1.5 back in March, but Wordfence reports blocking more than 17 million exploit attempts since activity ramped up in May, including a roughly 4-million-request spike on June 7. The fix is to update to 2.1.5 or later and rotate every key and token in the plugin’s connectors.

Splunk RCE deadline passes — exploited eight days after patch. The federal deadline on CVE-2026-20253 (CVSS 9.8, an unauthenticated file create/truncate flaw via the PostgreSQL sidecar chained to remote code execution) ran out Sunday, June 21, under the CISA KEV entry added June 18. The timeline is worth internalizing: the patch shipped June 10, a proof-of-concept was published June 12, and confirmed in-the-wild exploitation followed by June 18 — eight days from fix to confirmed abuse. The upgrade path is version 10.4.0, 10.2.4, or 10.0.7 and later; a sidecar-disable workaround exists but can break Edge Processor, OpAmp, and SPL2 pipelines, so patching is the preferred route.

SolarWinds Serv-U DoS actively exploited. CISA added this unauthenticated denial-of-service bug (CVE-2026-28318, CVSS 7.5) to its Known Exploited Vulnerabilities catalog, citing in-the-wild exploitation; a crafted POST request with a Content-Encoding: deflate header crashes the Serv-U service without authentication. Federal remediation was due June 19; the fix is Serv-U 15.5.4 Hotfix 1, with an interim mitigation of blocking requests carrying that header.

So what: This week’s pattern keeps repeating: the infrastructure meant to move or defend data — file transfer, SaaS connectors, endpoint agents — keeps becoming the attack surface. A vendor-neutral view across any single product’s failure is the durable position.

Microsoft pins Mastra AI npm supply-chain attack on North Korea’s Sapphire Sleet. In a roughly 45-minute window on June 17, attackers who had compromised an npm maintainer account published 141 packages in the @mastra AI-framework scope, each injecting a malicious “easy-day-js” dependency — a typosquat of the popular dayjs library — that executed at install time to steal credentials, crypto-wallet data, and developer secrets. Because the payload fires on npm install or update, any developer workstation or CI/CD runner that pulled the poisoned versions was exposed regardless of whether the package was actually imported. Microsoft attributes the attack to Sapphire Sleet (also known as BlueNoroff).

So what: The AI tooling boom has handed adversaries a high-trust, high-velocity distribution channel: the dependency graph of the frameworks everyone is racing to adopt. Defense has to shift left, toward build-pipeline visibility and install-time behavior — you can’t detect what a postinstall script did if you’re only watching production.

AI executive order’s CISA mandates start shaping the patch regime. The June 2 executive order, “Promoting Advanced AI Innovation and Security,” directs CISA to issue new Binding Operational Directives prioritizing cyber defense of civilian systems, and stands up a Treasury/NSA/CISA “AI cybersecurity clearinghouse” for coordinated vulnerability scanning and patch prioritization — explicitly voluntary, with no mandatory model licensing. The Splunk and SolarWinds KEV deadlines this month are a preview of where risk-based, exploitability-driven federal patching is heading.

So what: Federal patching is consolidating around exploitability and impact rather than fixed timelines, and the contractor base inherits that shift through procurement. “Triage and remediate in days” is impossible without continuous exposure and exploitation visibility.