In June attackers got into Klue, a competitive-intelligence vendor, through a compromised legacy credential on an integration service, then used the OAuth tokens that connect Klue to platforms such as Salesforce; Klue says it identified the incident on 12 June.
Nothing exotic: an old credential and delegated access working exactly as designed. Close to home for anyone with tools plugged into their CRM, which is everyone.
Why can’t we have device-bound access and refresh tokens?
Sources: Techfinitive
