Third-Party OAuth Tokens Have Become a Preferred Entry Point for Enterprise Data Theft (ft. Gregory Richardson)
A SaaS integration breach hit cybersecurity vendors themselves. A single malicious webpage gave an AI agent full host control. And the security tools defenders depend on became the week's most exploit
INTRODUCTION
Icarus abused Klue’s Salesforce integration to steal CRM data from cybersecurity firms. Microsoft showed how a single malicious webpage can turn an AI browsing agent into a host-level execution path. Attackers moved on a critical Splunk Enterprise flaw fast enough that federal agencies were given days to respond. UNC6508 spent years inside research environments through exposed REDCap servers. And the FortiBleed campaign exposed roughly 74,000 administrative and VPN credentials from Fortinet devices across 194 countries by cracking legacy hash formats that survived firmware upgrades.
None of these required beating a hardened enterprise perimeter directly.
The common thread is trust that was granted once and never revisited. OAuth tokens persisted after approval. Localhost services assumed the internet could not reach them. Security platforms were treated as observers instead of attack surfaces. Research applications were categorized as operational tools rather than strategic targets. Network appliance credentials remained in cracking-vulnerable hash formats long after the fix shipped. Attackers are operating exactly where defenders stop validating.
If your incident response plan assumes the compromised asset is something you control, what happens when the breach starts in a vendor’s vendor?
This week we are joined by Gregory Richardson, founder of 6 Levers AI Consulting & Coaching and author of 6 Technology Levers. Gregory brings more than thirty years as an ethical hacker and CISO-level advisory experience with Fortune 500 companies, paired with a focus on practical AI strategy. His throughline across this issue is consistent: most of these are old weaknesses that get more lethal in the AI age, and the fix is to get the basics right. Full bio at the end.
Get The Monday Brief in your inbox every Monday. Subscribe for free, and share it with someone who’d find it useful.
Thanks for supporting us.
WEEKLY SIGNALS ANALYSIS
Vendor integrations are not inside your trust boundary. They are your trust boundary. Audit every third-party OAuth integration connected to your Salesforce, Microsoft 365, and CRM instances this week. The Klue breach proved that a single compromised app token gives an attacker read access to your most sensitive customer data, and Salesforce had to disable the integration on your behalf because most customers could not do it themselves.
AI agents inherit trust assumptions that were never designed for autonomous software. Microsoft’s AutoJack research shows that browsing agents trust localhost services the same way a human developer would, but without the judgment to recognize a malicious page. If you are deploying AI agents with browser access, restrict their ability to interact with local services and enforce authentication on every localhost endpoint.
Your security monitoring platform is now a high-value target, not a safe observer. Splunk Enterprise CVE-2026-20253 went from disclosure to active exploitation in days. Prioritize patching your detection infrastructure with the same urgency you apply to internet-facing applications, because attackers understand that blinding the SOC is worth more than compromising a single endpoint.
Long-dwell espionage campaigns punish organizations that equate “no alerts” with “no compromise.” UNC6508 operated undetected for over two years inside research networks. If your threat hunting program does not actively search for backdoors in REDCap and similar research platforms, absence of evidence is not evidence of absence.
Network appliance credentials are not protected by the patches that protect the appliance. The FortiBleed campaign cracked credential hashes from tens of thousands of Fortinet devices, exposing admin and VPN credentials even on systems running current firmware. If your appliance credentials have not been rotated since the device was deployed, treat them as compromised. Patching the device does not invalidate previously-leaked credentials.
What not to over-index on: prompt injection as the entire AI-agent risk. AutoJack is not just a prompt problem. It is a boundary problem between untrusted web content, localhost services, and agent execution privileges.
THIS WEEK’S SIGNALS
Signal 1: Klue OAuth Breach Lets “Icarus” Actors Steal Salesforce Data From Cybersecurity Vendors
Why it matters: Attackers compromised the OAuth token that Klue’s Battlecards integration used to connect to customer Salesforce instances, exfiltrating CRM data from organizations including cybersecurity vendors Huntress and Recorded Future. This is the third integrated Salesforce application compromised for data theft, establishing a clear pattern where SaaS-to-SaaS integrations are the preferred extraction path.
What is being misread: Most organizations treat OAuth app integrations as a one-time approval decision rather than a persistent, auditable access channel. The architectural flaw is that Salesforce integrations receive broad data access scopes at connection time, and those scopes persist indefinitely without re-authorization. Defenders focus on user credential hygiene while third-party app tokens sit unmonitored with read access to the entire CRM. The broken mental model is “we control who logs in,” when the actual risk is “we forgot what we already let in.”
Guest Perspective (Gregory Richardson): Here is another example of an old weakness, that only gets more lethal (and pervasive) in the AI age. I expect this to get even worse as we transition to more data sharing paradigms (MCP’s datalakes, etc). Like passwords, OAuth was never designed to support the kind of large scale authentication it is being used for now. There’s a reason attackers keep attacking this obvious soft spot and we keep reading about such compromises.
Think Red (Douglas McKee): I do not need to phish a single employee or bypass MFA (which isn’t hard either). I compromise one SaaS vendor’s OAuth plumbing, and I inherit read access to every customer instance that ever clicked “Authorize.” The beauty is that the data flows through a legitimate API channel. Your DLP will not flag it because the integration was designed to move exactly this kind of data. I am just the wrong person reading it. Your security team is hunting for anomalous logins while I am browsing your pipeline data through a connection your sales ops team approved eighteen months ago and never reviewed again.
Act Blue (Ismael Valenzuela): The reality most teams face is that nobody owns the inventory of third-party OAuth integrations. Sales ops approved Klue. IT may not even know it exists. Start by pulling a complete list of connected apps in Salesforce (Setup > Connected Apps OAuth Usage) and cross-reference it against your approved vendor list. Revoke anything that is not actively justified. But do not stop there. Even after revocation, you need to audit what data those tokens accessed during their lifetime. Enable Salesforce Event Monitoring to capture API-level read events from connected apps, and set alerts for bulk data exports through any OAuth-connected application. The principle here is simple. Every integration token is a standing credential. Treat it like one.
Supporting sources:
BleepingComputer: Klue OAuth breach linked to ‘Icarus’ Salesforce data theft attacks
SecurityWeek: Cybersecurity Firms Impacted by Klue Supply Chain Attack
Dark Reading: Salesforce Data Thefts Continue via Klue App Compromise
The Hacker News: Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data
Signal 2: Microsoft’s AutoJack Research Proves a Single Webpage Can Achieve Host-Level RCE Through AI Browsing Agents
Why it matters: Microsoft demonstrated AutoJack, a proof-of-concept attack chain where a malicious webpage rendered by an AI browsing agent can bridge untrusted internet content to localhost services and achieve remote code execution on the host running the agent. The research used AutoGen Studio, Microsoft’s open-source multi-agent framework, and showed that missing authentication on local services, unsafe parameter handling, and agent-driven browsing can combine into host-level execution with the agent’s privileges.
What is being misread: The industry treats AI agent security as a prompt injection problem. AutoJack reveals something more fundamental. The broken assumption is that localhost services are safe because they are not internet-facing. AI browsing agents bridge the gap between the open internet and the local machine, turning every unauthenticated local API into an internet-reachable attack surface. The agent itself becomes the proxy, and no amount of prompt hardening fixes a missing authentication check on a local service.
Guest Perspective (Gregory Richardson): Yes, this is a tricky one and tough to solve. This is complicated by a double-edged sword viz. Edge 1, even non-internet-facing services could potentially be reachable now and edge 2, layered, chained attacks like this, which can be very complex, are now more within reach of less capable “script-kiddies”. This is a very real problem in the age of AI (today) as evidenced in this research but can also be an opportunity to improve security testing time and effectiveness.
Think Red (Douglas McKee): I am inside your network the moment your AI agent visits my webpage. The agent trusts localhost because every developer tool trusts localhost. I do not need to exploit a memory corruption bug or chain three CVEs together. I send a crafted page, the agent processes it, and it makes a perfectly formed request to a local service that has no authentication because nobody expected the internet to reach it. The process executes with whatever privileges the agent has. Your network segmentation is irrelevant because the agent is the one making the call from inside the house.
Act Blue (Ismael Valenzuela): Most organizations deploying AI agents have not audited what local services those agents can reach. This is the immediate gap. Enumerate every localhost-listening service on machines running AI agents, and enforce authentication on each one, even internal development tools. Restrict AI agent processes to minimal-privilege accounts with no ability to spawn child processes or access sensitive local APIs. Network-level controls matter too. Deploy application-layer firewalls between the AI agent process and localhost services, and log every local API call the agent makes. If your agent framework does not support this level of observability, you are flying blind. The lesson is that any software component that bridges external content and internal execution needs the same controls you would put on a DMZ boundary.
Supporting sources:
Microsoft Security Blog: AutoJack: How a single page can RCE the host running your AI agent
CSO Online: Microsoft says web-enabled AI agents can trigger host-level RCE
Signal 3: Splunk Enterprise Unauthenticated RCE Exploited Within Days of Disclosure
Why it matters: CVE-2026-20253, a critical unauthenticated remote code execution vulnerability in Splunk Enterprise, went from vendor disclosure to confirmed in-the-wild exploitation so quickly that CISA gave federal agencies only three days to patch. Splunk is a core component of security operations for thousands of organizations. Compromising it does not just give attackers a foothold. It blinds the entire detection pipeline.
What is being misread: Security teams treat their own monitoring infrastructure as lower priority for patching because it sits “inside” the network. The architectural flaw is that some Splunk deployments expose data input or management surfaces across distributed environments. Defenders mentally categorize Splunk as a defensive tool rather than an attack surface, so it falls behind in patch cycles. The broken assumption is that security tools occupy a privileged, protected position in the network. They do not. They are software, and they are often more exposed than the assets they monitor.
Guest Perspective (Gregory Richardson): Yet another, age old paradigm that we in the cybersecurity industry did insufficient to address over the past decades. Properly segmented networks based on privilege should long have been a thing, but yet here we are. I’m noticing a theme here, we need to fix the basics rather than being so enamored with tools and widgets. Like I said and demonstrated with the OpenClaw debate of February 2026, building with security in mind absolutely can mitigate many a vulnerability.
Think Red (Douglas McKee): I do not start with your endpoints. I start with the system your endpoints report to. Splunk is valuable because it sees the environment, stores the evidence, and often connects to more systems than defenders realize. Now I can suppress my own alerts, inject false data, or simply use it as a pivot point into everything it is connected to. You will not see me because the thing that was supposed to see me is now working for me.
Act Blue (Ismael Valenzuela): The uncomfortable truth is that many Splunk Enterprise deployments are reachable from the internet, and security teams are often the last to know. Patch CVE-2026-20253 immediately. If you cannot patch within 72 hours, restrict network access to Splunk management ports to known IP ranges and disable any internet-facing data input endpoints until the update is applied. Conduct a broader audit of your security tooling exposure. Enumerate every management interface for your SIEM, SOAR, EDR console, and log aggregation platforms. Verify that none are directly internet-accessible without VPN or zero-trust network access controls. Set up external attack surface monitoring specifically for your security infrastructure. The principle is that your detection tools deserve the same patching urgency as your most critical production systems, because they are your most critical production systems.
Supporting sources:
BleepingComputer: CISA: Splunk Enterprise flaw actively exploited, patch by Sunday
SecurityWeek: Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure
Help Net Security: Unauthenticated RCE in Splunk Enterprise under active attack (CVE-2026-20253)
Rapid Risk Radar: CVE-2026-20253
Signal 4: China-Linked UNC6508 Operated Undetected Inside Research Networks for Over Two Years
Why it matters: Google exposed UNC6508, a China-linked espionage group that has been silently backdooring research institutions and critical infrastructure networks since at least 2023. The group targets outdated, internet-accessible REDCap servers for initial access and deploys backdoors designed for long-term, low-noise persistence. The UK’s NCSC chief warned the same week that hostile states are “prepositioning” throughout British critical infrastructure, gathering intelligence today for potential kinetic targeting tomorrow.
What is being misread: Organizations running research platforms like REDCap assume that because these systems handle academic or clinical data, they are not high-value espionage targets. The broken assumption is that espionage groups target based on the classification level of data rather than the strategic value of the institution. Research networks hold pre-publication data, clinical trial results, and intellectual property that nation-states consider worth years of patient collection. The majority of internet-accessible REDCap servers are running outdated versions, and defenders are not looking for compromise because they do not expect these systems to be targeted.
Guest Perspective (Gregory Richardson): I feel like I’m stuck in a Land of the Lost tachyon amplifier induced time warp of sorts. Literally the same kind of problem we spoke about with signal 3. FYI, state sponsored actors have been doing this for years. Now see https://www.cisa.gov/news-events/alerts/2025/08/27/cisa-and-partners-release-joint-advisory-countering-chinese-state-sponsored-actors-compromise, which some believe dates back 15 years or more. Want to be even more concerned? You don’t want to know how much military and other critical communications data and infrastructure backhaul happens via extremely poorly secured satellite infrastructure, see: https://satcom.sysnet.ucsd.edu/. Let me quickly tie this back to the AI age we are currently in, AI now suddenly allows us to quickly assess loads of this data, find relationships and build truly scary espionage data-repositories.
Think Red (Douglas McKee): I pick targets that depend on REDCap because REDCap gives me two favorable odds. The server will be outdated, and nobody will be watching it. A research institution’s IT team does not treat a clinical data collection tool as a tier-one asset. They patch it quarterly at best. I drop a lightweight backdoor, exfiltrate data in small batches that look like normal API usage, and wait. Two years is not a long time when nobody is hunting. The data I collect today shapes decisions that will matter in five years. Patience is cheap. Detection is expensive. I like those economics.
Act Blue (Ismael Valenzuela): Research institutions and organizations with academic partnerships face a specific problem. Their most strategically valuable systems are often their least monitored. Immediately inventory all internet-facing REDCap instances and verify they are running current versions. If any instance has been accessible from the internet for more than six months without a recent compromise assessment, treat it as potentially compromised and conduct a forensic review. Implement network-level anomaly detection for low-and-slow data exfiltration patterns on research platforms. Look for small, regular outbound transfers to unfamiliar destinations, especially during off-hours. Coordinate with threat intelligence feeds that track UNC6508 infrastructure indicators. The broader principle is that threat hunting must extend to systems your organization considers “low priority” but adversaries consider “high value.” If you only hunt where you expect to find threats, you will miss the ones that matter most.
Supporting sources:
CyberScoop: Google exposes China espionage group that’s been lurking in networks undetected since 2023
SecurityWeek: Majority of Internet-Accessible REDCap Servers Outdated
The Record: Hostile states behind three-quarters of attacks on Britain’s critical infrastructure, cyber chief warns
Signal 5: FortiBleed Campaign Exposes Credentials From Tens of Thousands of Fortinet Devices Across 194 Countries
Why it matters: FortiBleed is a two-mechanism campaign. Threat actors extracted configuration files from internet-facing FortiGate firewalls and cracked the stored credential hashes for offline access, and a Russian-speaking threat group separately conducted approximately 1.16 billion credential-stuffing attempts against more than 320,000 FortiGate SSL VPN endpoints to intercept authentication hashes live. The combined campaign exposed approximately 74,000 administrative and VPN credentials spanning 21,632 unique domains and 194 countries. Researcher Volodymyr Diachenko discovered the exposed credential database, and SOCRadar verified more than 30,000 of the credentials as still working. CISA issued an immediate advisory. Named exposures include Samsung, Mercedes-Benz, Foxconn, and multiple government agencies.
What is being misread: Organizations are framing this as another patch advisory. The architectural failure is that the exposure exploits legacy SHA-256 credential hashes that persist on FortiGate devices long after Fortinet shipped the fix. Fortinet introduced PBKDF2 hashing in FortiOS 7.2.11, 7.4.8, and 7.6.1, but the legacy hashes remain in configuration files until an administrator logs in after the upgrade. The broken assumption is that applying firmware updates eliminates legacy credential exposure. In practice, the old hashes survive the upgrade and remain crackable. The patch is necessary but not sufficient. The credential lifecycle is the actual fix.
Guest Perspective (Gregory Richardson): Expect more and more of these scale discoveries thanks to AI. As you read this, rumors are starting to float around the internet that Fable aka Mythos aka Glass-Wing(duck) was able to “crack” all of the NSA systems in hours. YES, I am skeptical of the sensational nature of the reports like this but on the other hand it does explain Anthropic’s directive received to limit access to the model. Either way, powerful models will make these discoveries more and more common. We’ll have to start building more efficient ways to mitigate everytime a vulnerability is found in our security infrastructure. We won’t be able to simply allocate fixes to maintenance windows anymore.
Think Red (Douglas McKee): I do not need your newest Fortinet vulnerability if I already have yesterday’s configuration file. The firewall is valuable because it stores the credentials, routes the traffic, terminates the VPN, and sits at the edge of everything you care about. If I can crack one admin hash, I do not need malware on an endpoint. I log in, change policy, create a backdoor user, and inherit the trust your network already gives the device. My objective is not full domain compromise on day one. It is durable control of the appliance that decides who gets inside. The real lesson is that patch state and credential state are not the same thing.
Act Blue (Ismael Valenzuela): The scale of this exposure demands an emergency response, not a scheduled maintenance window. For every Fortinet device in your environment, do four things this week. First, terminate all active SSL VPN and administrative sessions immediately. Second, reset every administrative and VPN credential, regardless of whether your specific device appears on the leaked list, because you cannot verify completeness. Third, enable phishing-resistant MFA on all administrative accounts. Fourth, restrict management interface access to a dedicated jump host on a management VLAN. However, the deeper fix is structural, and it is easy to get wrong. Requiring an administrator login after every device upgrade migrates the active credential to PBKDF2, but the legacy SHA-256 hash can survive in a hidden old-password field, where it remains crackable from an exported configuration. To actually strip it, enable the login-lockout-upon-weaker-encryption setting in the system password policy on FortiOS 7.6.x, or login-lockout-upon-downgrade on 7.2.x and 7.4.x. Then review the past 90 days of VPN session logs for authentications from unexpected geographies, especially those matching infrastructure linked to the Russian-speaking threat group described above. The broader principle holds for every appliance category. When the credential is the asset, the patch is the floor, not the ceiling.
Supporting sources:
Arctic Wolf: Active FortiBleed campaign impacting Fortinet devices across 194 countries
BleepingComputer: CISA warns Fortinet users to secure devices after FortiBleed leak exposes ~74,000 credentials
MEME OF THE WEEK
“It’s only listening on localhost” — famous last words.
ROLE-BASED TAKEAWAYS
Executive / CISO / Board Level
Third-party SaaS integration risk is now a board-level issue. The Klue breach hit cybersecurity vendors, not just ordinary enterprises. Direct your team to produce a complete inventory of all OAuth-connected applications across Salesforce, Microsoft 365, and other critical SaaS platforms within 30 days. Frame this to the board as supply chain risk that bypasses every perimeter control.
Security tool patching must be explicitly prioritized in your risk register. The Splunk RCE exploitation proves that attackers understand the value of blinding defenders. Establish a policy that security infrastructure (SIEM, SOAR, EDR consoles) receives patches within 48 hours of critical disclosure, ahead of standard production systems.
Long-dwell espionage campaigns require proactive investment, not reactive response. UNC6508 operated for over two years undetected. If your organization has research partnerships or academic affiliations, fund a dedicated threat hunting engagement focused on those environments.
FortiBleed exposes the credential-lifecycle gap in your network appliances. If your organization runs FortiGate firewalls or VPNs, authorize emergency credential rotation this week. The cost of a weekend maintenance window is far less than the cost of an attacker who already has your firewall password. Confirm with your CISO that PBKDF2 hashing is enforced and that legacy SHA-256 hashes have been purged from configurations.
Enterprise Architect
Design Principle Impact: The Klue and AutoJack incidents invalidate the assumption that authorized integrations and localhost services operate within a trusted zone. Adopt a zero-trust model for all SaaS-to-SaaS data flows and all AI agent-to-local-service interactions. Every API call, whether from an OAuth token or a localhost agent, must be authenticated, scoped, and logged.
New Constraint/Dependency: AI browsing agents create a new class of network bridge between untrusted internet content and trusted local services. Architect agent deployment environments with the same isolation controls you would apply to a DMZ, including process-level sandboxing, restricted localhost access, and mandatory egress filtering.
Operational Principle: Firmware updates do not invalidate previously-leaked credentials. FortiBleed shows admin and VPN credentials cracked from configuration files survive firmware upgrades, and an administrator login alone can leave the legacy hash in a hidden field. Architect appliance management to strip legacy hash formats as a deployment gate, not as a side effect of the next login.
Security Operations
Implementation Watch Item: Monitor Salesforce Connected Apps OAuth Usage logs for any Klue-related tokens that have not been revoked. Expand monitoring to all third-party OAuth integrations for unusual bulk data access patterns.
Common Failure Mode: Teams will assume Splunk is safe because the vulnerable PostgreSQL sidecar service only listens on localhost, not realizing Splunk Web proxies external requests straight to it. CVE-2026-20253 affects Splunk Enterprise 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6, not the forwarders. Confirm which of your indexers and search heads run an affected Enterprise version with the sidecar enabled, and do not assume an internet-facing Splunk Web means the backend is unreachable.
Monitoring Patterns: Watch for outbound API calls from Salesforce to deauthorized or unfamiliar OAuth endpoints. On Splunk infrastructure, watch for requests to PostgreSQL recovery endpoints (paths under /splunkd/__raw/v1/postgres/) and for outbound connections from Splunk to unknown PostgreSQL servers, alongside unauthenticated connections to management ports from non-whitelisted IPs. For UNC6508, hunt for anomalous small-volume data transfers from REDCap or research database servers to external IPs, particularly during non-business hours.
Signal vs Noise Guidance: A legitimate Salesforce integration will show consistent, predictable API call volumes. A compromised OAuth token will show either a sudden spike in bulk SOQL queries or a new pattern of accessing objects the integration never previously touched. For Splunk, any unauthenticated connection attempt to the management port is a genuine signal, not noise.
Fortinet credential rotation: Rotate all administrative and VPN credentials on every Fortinet device in your environment this week. Review the past 90 days of VPN session logs for authentications from unexpected geographies or off-hours.
Adversarial edge item: Run an OAuth revocation drill. Pick one non-critical SaaS integration, revoke it, measure what breaks, identify who owns restoration, and document how long it takes to determine what data the integration accessed. If your team cannot answer those questions during a drill, they will not answer them during an incident.
About this week’s guest
Gregory Richardson is the founder of 6 Levers AI Consulting & Coaching, where he helps business and organizational leaders harness AI to solve real problems rather than chase shiny objects. He brings more than thirty years in security as an ethical hacker, along with advisory work at the CISO level for Fortune 500 companies. He has a knack for translating highly technical AI concepts into language non-technical leaders actually understand, and has trained hundreds of executives and nonprofit leaders to use AI in their daily operations. He is the author of 6 Technology Levers, a roadmap for using technology to solve business problems, and the creator of the CREATE framework, which has guided organizations from startups to large enterprises through strategic technology adoption. A sought-after speaker and workshop facilitator, Gregory combines deep technical knowledge with a teacher’s instinct. Based in Dallas, Texas.
Find Gregory at gregoryrichardson.ai · 6 Levers AI Consulting · LinkedIn
See you next Monday!
The Monday Brief is produced by Douglas McKee and Ismael Valenzuela. The opinions expressed are our own and do not reflect those of our employers.