Synthesized by Clarity (Claude) from 9 sources · May contain errors — spot one? [email protected] · Methodology →
Klue OAuth Token Theft Pivots Into CRM via Trusted SaaS App
- Sources
- 9
- Words
- 1,155
- Read
- 6min
Topics Agentic AI LLM Inference AI Regulation
◆ The signal
Your EDR and CASB are blind to this pattern because the malicious access authenticates as a legitimate OAuth app blending into normal API traffic. Audit every SaaS-to-SaaS OAuth grant this week, starting with anything touching your CRM.
◆ INTELLIGENCE MAP
Intelligence map
01 SaaS-to-SaaS OAuth Token Theft Hits Production
act nowKlue's stolen OAuth tokens gave attackers direct access to LastPass's Salesforce tenant. No credentials phished, no malware deployed — the kill chain is entirely abuse-of-trust through long-lived, over-scoped OAuth grants invisible to EDR/CASB. CRM contact data exfiltrated fuels targeted BEC.
- Attack vector
- Data exfiltrated
- Vaults affected
- Detection coverage
- Klue compromisedOAuth tokens stolen from vendor
- Token replayedAuthenticated as legitimate app
- Salesforce accessedCRM data exfiltrated
- BEC fuel generatedNamed customer details taken
02 0DIN Proves AI Agents Execute Attacker Payloads From Clean Repos
act nowMozilla 0DIN demonstrated a three-stage attack where a clean-passing GitHub repo tricks Claude Code into running a DNS-swappable reverse shell. The payload changes after code review passes, structurally defeating point-in-time scanning. Agents now also autonomously provision accounts, register domains, and initiate payments.
- Attack target
- Evasion method
- Poisoning cost
- Model manipulation
- Traditional supply-chain60Catchable by SCA
- 0DIN AI-agent attack95Defeats code review
03 4K Deepfakes + Offline Agents Defeat Two Core Detection Assumptions
monitorByteDance Seedance 2.5 produces 30-second 4K video deepfakes in one pass with character/voice continuity. Simultaneously, frontier coding agents (Ornith 1.0, Qwen-AgentWorld) now run offline on a single consumer GPU under Apache 2.0. Resolution-based deepfake tells and API telemetry monitoring both fail.
- Video length
- Reference fusion
- Ornith hardware
- Visual auth window
04 Cost Pressure Driving Unvetted Model Adoption
monitorCoinbase cut AI spend nearly in half by defaulting to Chinese open-weight models while increasing usage. AWS simultaneously raised AI workload prices 20%. Finance teams will force this decision across the industry — without security review — unless you gate model swaps now.
- Coinbase savings
- AWS price increase
- Usage change
- GPT-5.6 Luna tier
05 AI Compute Vendor Concentration and Financial Distress
backgroundCoreWeave insiders dumping eight-figure stock daily with zero insider buying since IPO. Bending Spoons IPOs at ~$18B after absorbing AOL, Vimeo, Eventbrite, Evernote — Dropbox flagged as next target. Nvidia consolidated Groq's IP/founder. AI infrastructure is concentrating into fewer, potentially unstable hands.
- CoreWeave insider buys
- Bending Spoons targets
- Dropbox market cap
- SK Hynix raise
- 01Bending Spoons IPO18
- 02SK Hynix HBM raise29.4
- 03ByteDance AI infra20
- 04Dropbox (acq. target)6
◆ DEEP DIVES
Deep dives
01 Klue→LastPass: The SaaS-to-SaaS OAuth Kill Chain Your EDR Can't See
act nowWhat Happened
An unauthorized actor compromised market-intelligence vendor Klue and stole OAuth tokens that Klue held for its integration with LastPass's Salesforce CRM. The attacker replayed those tokens directly against Salesforce, authenticating as the legitimate Klue application and exfiltrating customer contact and CRM data. LastPass confirmed vaults and core infrastructure were unaffected — but named customer data walked out the door.
No phishing. No malware. No credential stuffing. Just a third-party's over-scoped, long-lived OAuth token replayed against your downstream tenant. That's the new perimeter breach.
Why This Is Different
This is not a novel technique — it's the same SaaS-to-SaaS OAuth abuse pattern seen in Salesloft/Drift-style campaigns — but it now has a high-profile victim and a clean kill chain to brief leadership on. The critical detection gap: your EDR sees nothing because no endpoint is compromised. Your CASB likely misses it because the OAuth app is legitimate and the API traffic patterns blend with normal usage. The malicious access is indistinguishable from authorized access at the network and endpoint layers.
Kill Chain
- Compromise the integration vendor (Klue)
- Harvest OAuth tokens granted by downstream customers
- Replay tokens against Salesforce/CRM tenants
- Exfiltrate data that authenticates as legitimate app activity
Downstream Consequences
The exfiltrated CRM data — named contacts, account relationships, deal stages — is premium fuel for spear-phishing and BEC. Attackers now know which customers use LastPass, who their account contacts are, and potentially deal context. Expect highly convincing LastPass-branded lures referencing real account details within weeks.
Your Exposure
If your organization uses any market-intel, sales-enablement, or CRM-connected SaaS tool with OAuth grants into Salesforce, HubSpot, or similar platforms, you share LastPass's exposure profile. Most organizations have dozens to hundreds of these grants, approved once during onboarding and never audited again.
Cross-Source Context
This breach validates the broader pattern multiple sources flagged today: the non-human identity problem is now manifesting in production. Whether it's OAuth tokens (this incident), AI agent credentials (0DIN research), or autonomous provisioning capabilities, the common thread is machine identities with standing access that humans don't monitor.
Action items
- Enumerate every OAuth grant connecting third-party SaaS to your CRM/Salesforce by end of week — revoke unused grants, downscope over-permissioned ones, enforce 90-day token rotation
- Issue targeted BEC advisory to help desk, finance, and exec assistants warning of LastPass-branded lures using real CRM data within 48 hours
- Deploy Salesforce Event Monitoring or equivalent to alert on OAuth app access anomalies (unusual query volumes, bulk exports, new IP origins) this sprint
- Require security review for all new SaaS-to-SaaS OAuth integrations and annual re-certification of existing grants starting this quarter
Sources:Klue's stolen OAuth tokens hit LastPass's Salesforce — your SaaS-to-SaaS OAuth grants are the new soft perimeter
02 0DIN's Proof: Clean Repos Become Reverse Shells When AI Agents 'Help'
act nowThe Research
Mozilla's 0DIN team published a working three-stage supply-chain attack against AI coding agents. A GitHub repository that passes clean code review includes a deliberate fake 'install error' that instructs the agent to run
python3 -m axiom init. That command resolves a DNS-controlled payload that opens a reverse shell. The agent never 'decides' to open a shell — it decides to fix an error. The distinction is everything.Claude Code never decided to open a shell — it decided to fix an error. And that error was the attacker's entire kill chain.
Why Point-in-Time Scanning Dies Here
The payload is DNS-swappable. The repository passes every SAST, SCA, and human review gate. Days or weeks later, the DNS record changes, and the same 'clean' code delivers a reverse shell. Your Dependabot, code signing, and SBOM controls assume static malice — this attack is temporally dynamic. The primary defense is containment, not detection at the code layer.
Compounding Factor: Agents Now Provision Infrastructure
Multiple sources confirm coding agents have crossed from code-completion into autonomous infrastructure actions: registering domains, provisioning accounts, initiating payments, and obtaining credentials with limited human oversight. O'Reilly's 2026 Technology Radar formally names credential leakage from coding agents as a significant emerging threat. A compromised agent that can also spend money and stand up infrastructure is no longer just a data exfiltration risk — it's an attacker infrastructure builder.
Attack Comparison
Dimension Traditional Supply-Chain 0DIN AI-Agent Attack Trigger Malicious dependency at build Agent 'fixes' fake install error Code review Sometimes catchable Repo is clean; payload swaps post-review Privilege context CI service account Developer's full local context + provisioning Primary defense SCA / signing / SBOM Sandboxing + egress control + behavioral detection Defensive Tooling Catching Up
PydanticAI V2 shipped native guardrails, code-execution controls, and deferred tool loading. SARC wraps frameworks to enforce constraints. These aren't mature enough to rely on alone, but they represent a governance layer that didn't exist 90 days ago. Adopt them as defense-in-depth, not primary control.
Action items
- Enforce container/VM isolation for all AI coding agents (Claude Code, Codex, Cursor) with no direct access to production credentials, SSH keys, or cloud tokens — implement by end of sprint
- Deploy DNS and egress allowlisting on developer hosts running AI agents; alert on connections to newly-observed domains
- Cap agent service-account privileges: no payment, domain-registration, or account-creation scopes without human-in-the-loop approval gate
- Add malicious-repo and install-error-remediation scenarios to AI red-team exercises this quarter
Sources:That AI coding agent on your devs' machines? 0DIN just weaponized a clean GitHub repo to hand attackers a reverse shell · Your devs' AI coding agents can now provision accounts, spend money, and leak creds — time to threat-model them
03 Seedance 2.5 + Offline Agents: Two Detection Assumptions Just Failed
monitorThe Capability Shift
Two releases landed this week that independently remove detection assumptions most security teams still rely on:
- ByteDance Seedance 2.5 generates native 30-second 4K video in a single pass, fusing up to 50 references (images, video, audio, character sheets) while preserving character identity, lighting continuity, and physics. This isn't a demo reel — it's production-grade executive impersonation at a resolution that defeats the cheap visual inspection tell.
- Frontier coding agents run fully offline on consumer hardware: Ornith 1.0 (30B-A3B) on a single RTX 4090 or M3 Max; Qwen-AgentWorld on one H100 or dual RTX 5090s. Both are Apache 2.0 licensed, uncensored, and generate zero API telemetry.
An agent that runs without a network connection leaves no API call to log, no cloud provider to subpoena, no rate limit to throttle the operator. The model sits on the endpoint. The activity stays local.
What Defenders Lose
Resolution as a deepfake tell is gone. Earlier synthetic video degraded under scrutiny — artifacts, temporal inconsistency, sub-1080p output. Seedance 2.5 at 4K with character continuity eliminates this. The world's leading digital-forensics expert, Hany Farid, now publicly states he fails his own real-vs-fake image tests and warns the human visual system will be 'utterly useless' for authentication within 1-2 years.
API-layer monitoring is bypassed. If your shadow-AI detection relies on outbound calls to OpenAI/Anthropic/model-vendor APIs, offline agents are invisible. They consume no tokens from a metered endpoint. Your CASB won't flag them. Your DLP won't intercept the prompts. The only evidence is GPU utilization on the endpoint.
Combined Threat Scenario
A threat actor generates a 4K video of your CFO requesting an urgent wire transfer (Seedance 2.5), then uses an offline agent to research your org, craft the pretext, and orchestrate delivery — all from a single workstation with no network calls that would trigger monitoring. The entire attack chain produces zero cloud telemetry.
Detection Investment Required
Lost Assumption New Detection Requirement Tooling Gap Video resolution = authenticity Out-of-band verification mandates Process, not technology AI usage = API calls Endpoint GPU monitoring + model-cache detection EDR enrichment needed Voice = identity Pre-shared challenge phrases + callback Process change Practical Limits
Caveat: Seedance 2.5 generates 30-second clips, not real-time interactive video. Live deepfake conversations remain harder. The threat is pre-recorded video messages, voicemails, and asynchronous communication — not yet a Zoom call impersonation. But 30 seconds is enough for a voicemail or a short video 'urgent request.'
Action items
- Mandate out-of-band verification (callback to known number + pre-shared challenge phrase) for any financial transfer, credential reset, or privileged-access request — explicitly prohibit video/voice alone as proof of identity, effective immediately
- Deploy EDR rules to detect large model downloads (Ollama/HuggingFace caches >5GB) and sustained GPU-bound inference on managed endpoints by end of sprint
- Run deepfake-aware phishing simulation against finance and exec-support teams this quarter, using synthetic video/audio lures
- Pilot C2PA content provenance for outbound executive communications
Sources:Two capabilities landed at once. The first is 4K deepfakes generated in a single pass. The second is agentic models that run offline. · That AI coding agent on your devs' machines? 0DIN just weaponized a clean GitHub repo to hand attackers a reverse shell · Clarity flagged it: cheap GPT-5.6 'Luna' + agentic memory = your next attack surface
◆ QUICK HITS
Quick hits
Update: Coinbase publicly confirmed cutting AI spend ~50% by defaulting to Chinese open-weight models while increasing token usage — AWS's simultaneous 20% AI price hike will push more orgs down this path without security review
Coinbase swapped to Chinese AI models to halve costs — your stack is next on that path
Bending Spoons IPOs July 2 at ~$18B after acquiring AOL, Vimeo, Eventbrite — if these are in your vendor stack, pull fresh DPAs and SOC 2 reports; Dropbox (~$6B, founder stepping down) flagged as next acquisition target
Coinbase swapped to Chinese AI models to halve costs — your stack is next on that path
CoreWeave (CRWV) insiders dumping eight-figure stock daily with zero insider buying since IPO — check if any production workloads run on challenger GPU clouds and document egress paths
Your AI compute vendors (CoreWeave, IREN) flash distress signals — third-party risk check needed
Minimus launched a free Community Edition of hardened container images pre-validated for FIPS, CIS, NIST SP 800-190, and STIG — drop-in replacements with no procurement gate; pilot against highest-compliance-burden workloads
Klue's stolen OAuth tokens hit LastPass's Salesforce — your SaaS-to-SaaS OAuth grants are the new soft perimeter
Nature research: just 6,400 state-scripted documents made an open-weight model produce pro-government answers ~80% of the time; state-coordinated content appears at 41× the rate of Chinese Wikipedia in training sets
That AI coding agent on your devs' machines? 0DIN just weaponized a clean GitHub repo to hand attackers a reverse shell
Valsorda argues LLMs now find vulnerabilities nearly as well as human researchers, eroding disclosure window value — tighten patch SLAs for internet-facing assets assuming compressed disclosure-to-exploit timelines
Klue's stolen OAuth tokens hit LastPass's Salesforce — your SaaS-to-SaaS OAuth grants are the new soft perimeter
◆ Bottom line
The take.
Three attack patterns converged today: an attacker stole Klue's OAuth tokens and walked into LastPass's Salesforce without touching a single endpoint (audit your SaaS grants now), Mozilla proved a clean GitHub repo can give AI coding agents a reverse shell that survives code review (sandbox your agents), and ByteDance shipped 4K deepfakes that the world's top forensics expert can't distinguish from real — if your wire-transfer verification still trusts a face or a voice, it trusts a model output.
Frequently asked
- Why can't my EDR or CASB detect the Klue-style OAuth token replay attack?
- Because the attacker authenticates as a legitimate OAuth application, not a compromised endpoint or user. No malware runs, no credentials are stuffed, and the API traffic patterns blend with normal integration activity. EDR sees nothing at the endpoint layer, and CASB treats the app as authorized. Salesforce-native Event Monitoring is currently the only reliable detection layer for anomalous query volumes or bulk exports.
- What should I audit first if I only have a week to reduce SaaS-to-SaaS OAuth exposure?
- Start with every third-party OAuth grant touching your CRM (Salesforce, HubSpot). Enumerate the grants, revoke anything unused, downscope over-permissioned ones, and enforce 90-day token rotation. Market-intel and sales-enablement tools are the highest-priority targets because they typically hold broad read access to named contacts and deal data — the same profile Klue held into LastPass.
- How does the 0DIN attack defeat traditional code review and SCA tooling?
- The malicious repository is genuinely clean at review time. The payload lives behind a DNS record that resolves to benign content during scanning and swaps to a reverse shell later. SAST, SCA, SBOM, and code signing all assume static malice, so they pass the repo. The AI coding agent then executes a fake 'install error' remediation step, running the DNS-controlled payload with the developer's full local privileges.
- What detection signal remains for offline AI agents that generate no API traffic?
- Endpoint telemetry — specifically large model-file downloads (Ollama or HuggingFace caches over ~5GB) and sustained GPU-bound inference on managed workstations. Since offline agents like Ornith 1.0 and Qwen-AgentWorld produce zero cloud API calls, CASB and DLP are blind. EDR enrichment for model artifacts and GPU utilization patterns is the only remaining visibility layer.
- Is a 4K deepfake actually usable in a real attack today, or is this still hype?
- It is usable for asynchronous attacks now, but not yet for live interactive video. Seedance 2.5 produces 30-second 4K clips with character and lighting continuity — enough for a convincing voicemail, recorded video message, or 'urgent request' clip attached to an email. Real-time Zoom impersonation remains harder. Treat pre-recorded executive video and voice as untrusted, and require out-of-band callback verification for any sensitive request.
◆ Same day, different angle
Read this day as…
◆ Recent in security
Keep reading.
- GPT-Red Beats Human Red Teams 84% to 13% on Frontier LLMs
- SonicWall SMA1000 CVSS 10 Zero-Day Under Active Exploitation
- Entra ID OAuth Client-ID Spoofing Sprays Hide in AADSTS Noise
- FSB Center 16 Exploits 18-Year-Old Cisco Flaw in Critical Infra
- Dormant GitHub Account Ships One-Click LoadMaster RCE Kit
Spot an error? [email protected]