Your Salesforce has a fangblenny problem

A fish that mimics a trusted cleaner well enough to bite you is basically a case study in OAuth token abuse, and Klue just proved it.

On coral reefs from East Africa to French Polynesia, certain fish run what biologists actually call "cleaning stations." A bluestreak cleaner wrasse sets up shop on a piece of coral, does a little shimmying dance to announce it's open for business, and bigger fish line up and hold still while it picks parasites and dead skin off their bodies, sometimes right out of their gills, sometimes out of their mouths. It's a real service, it's mutually beneficial, and it runs entirely on trust. The client fish has to let something small swim inside its mouth without eating it.

Then there's Aspidontus taeniatus, sometimes called the false cleanerfish or the sabre-toothed blenny. It doesn't just look like a cleaner wrasse, same blue stripe, same shape. It learned the dance too, the same ritualized approach real cleaners use to signal it's safe to hold still. Client fish wave it through just like the real thing. Then it bites a chunk of skin, scale, or mucus off the host and bolts, the aquatic equivalent of a contractor who takes the deposit and stops returning calls.

That's not a metaphor I'm stretching to fit. Biologists call it aggressive mimicry, which is a very calm name for a fish committing identity theft with its whole body. It works because the host fish's trust check happens once, at the door, and never again for the length of the interaction.

Which is more or less what happened to about fifteen companies over the back half of June. A company called Klue, which sells competitive intelligence software, got breached through a credential nobody remembered still worked. The attacker used it to mint tokens every downstream system recognized as legitimate Klue, the same way a host fish recognizes the dance and not the fish doing it.

What actually happened at Klue

On June 11 and 12, an extortion group calling itself Icarus got into Klue's backend using a compromised legacy credential, which Klue's CEO later said had been created for a prototype integration abandoned years ago and never turned off. Once inside, Icarus pushed a code update built to harvest OAuth tokens, the authorization keys that let Klue talk to the tools its customers had connected it to: Salesforce, HubSpot, Zoom, Slack, and a few others.

With those tokens in hand, the attacker didn't need a password. Didn't need to beat MFA. Didn't need anyone to click anything. Salesforce saw a request carrying a valid Klue token and did exactly what it was built to do: let it in, and hand over the data. Security researchers later traced automated queries pulling contacts, deal records, and support case details in bulk.

By the time the dust settled, at least a dozen companies had confirmed impact, including HackerOne, Huntress, Snyk, Tanium, OneTrust, LastPass, and BeyondTrust. Read that list again. A bug bounty platform. An endpoint security firm. A password manager. Companies that sell "we'll catch the thing you missed" for a living, caught by the thing they missed. If you run a security company, you normally get to feel a little superior about other people's breaches. Nobody on this list gets to this month.

Icarus was presumably going for menacing. What actually landed in inboxes was a ransom email with a "top secret" subject line, signed by someone using the name Mr. Bean, written in English that suggested it had survived three separate translation apps. Somewhere, a security researcher opened a genuinely serious breach notification from a cartoon character with bad grammar and had to answer it anyway.

The token is the fish, not the face

Here's the part that should bother you even if you've never heard of Klue. An OAuth token isn't a lesser version of a password, it's a full stand-in for identity, deliberately designed that way so your tools don't have to keep asking you to log back in. When you click "Allow" on some app's request to connect to your Google Workspace, your Slack, or your Salesforce, you're handing over a token that says, indefinitely or until revoked, "anything holding this is authorized to act as me."

Salesforce didn't get compromised. Its defenses worked fine. It just did what every system with OAuth built in is supposed to do: check the token, not the face behind it. It's the same move as a bouncer who scans your wristband and never looks up at your actual face, which works great until someone lifts the wristband off you. That's the same failure mode as the fangblenny problem. The host fish's actual biology for fighting off predators is perfectly functional. It just never gets triggered, because the check that matters (is this the real cleaner wrasse?) happens once, visually, at the start, and never again.

The fifteen-person version of the Klue problem

It's tempting to read "cybersecurity firms breached through a CRM integration" and file it under enterprise problems, the kind with a dedicated security team. It isn't. A 15-person software shop running Salesforce, HubSpot, or just Google Workspace has connected apps too, probably more than anyone remembers authorizing. Every "sign in with Google" for a tool someone tried once, every Zapier automation built at 11pm to save twenty minutes: each one is a standing token with access that outlives the person who set it up.

Where SMBs typically get this wrong:

Nobody owns the list. Connected apps accumulate one "Allow" click at a time, until your Google Workspace has an app called something like PDFConverterPro, authorized by a contractor in 2023 to merge two files once, that still reads company email. Scopes get granted at the ceiling, not the floor. Most OAuth consent screens offer one tier of access, broad, and almost nobody edits it down. Offboarding covers people, not tokens. When an employee leaves, someone remembers to pull their login. Almost nobody checks what tools that employee had personally authorized to connect to company systems. "We haven't used that in months" reads as harmless. It's the opposite. An unused integration with a live token is a door nobody's watching, which is exactly the Klue credential's whole biography. Vendor reviews stop at onboarding. Companies vet whether a new tool is trustworthy, then never look again once it's connected, even as that vendor's attack surface changes underneath them.

One thing worth understanding

A password protects an account. A token protects a relationship, and relationships, once established, tend to get checked far less often than they were at the start. That's not a flaw somebody forgot to patch. It's the entire point of OAuth: build the trust once, so the machines don't have to keep re-earning it on every request. So the security question was never "is this integration safe," asked once when you connected it. It's "is this integration still exactly what I authorized," asked periodically, for as long as the token lives.

That reframes the task. You don't need to read every API call your CRM integrations make, any more than a reef fish needs to re-inspect every cleaner that swims up. What you need is a standing habit of pulling the actual list. Google Workspace keeps one under Security, Salesforce calls it Connected Apps OAuth Usage, Microsoft 365 has an equivalent. Put one name on it, quarterly, calendared like a tax deadline, because "someone should probably check that" is how the Klue credential survived long enough to matter. The rule for each entry is short: if you don't recognize the app, revoke it. If you recognize it but nobody's opened it in ninety days, revoke it anyway and deal with the complaints, because there won't be many. A tool like Shielda will surface connected apps with excessive scopes or dormant ones, but the habit costs nothing beyond the free admin panel your provider already gives you and twenty minutes on a Friday.

One last thing

The false cleanerfish doesn't usually get caught by losing a fight. On the rare occasions it does, it's because some observant fish clocks the dance being slightly off: a beat too fast. Your OAuth tokens don't announce themselves as compromised either. Nobody at Klue's customers got phished. The dance looked exactly right, all the way up until it wasn't. The only real defense is looking at the list every so often, on a day when nothing's wrong, instead of waiting for the day something obviously is.