Index live· 1,284 files · 148 editions
ForensicPost

Search the index

3 results
Try
Results for “OAuth token theft”Newest first
26-0611
File

Klue Compromise Reached Salesforce Environments at Two Dozen Customers

A legacy credential and stolen OAuth tokens reached Salesforce environments at ~24 customers. The tokens were used exactly as designed.

UnattributedOAuth token theftCloudTokens
Sev 4TargetKlueActorUnattributed
25-0826
File

Cloudflare Says 104 API Tokens Were Exposed via Pasted Support Cases

Everyone scans repositories for committed secrets. Almost nobody scans the ticket system, which accumulates the same material indefinitely.

UNC6395OAuth token theftCloudSupply chain
Sev 4TargetCloudflare case recordsActorUNC6395USA
25-0818
File

One Integration, Seven Hundred Customer Environments

700+ organisations queried through one integration’s stolen tokens. Nothing was exploited; the tokens worked exactly as designed.

UNC6395OAuth token theftCloudTokens
Sev 5TargetSalesloft Drift integrationActorUNC6395
ForensicPost

Independent reporting on digital forensics and incident response.

SectionsBreachesRansomwareNation-stateCloud
DataCase filesData exportActor indexGlossaryMethodology
ContactSecure tipsCorrectionsThe deskEthics
© 2026 ForensicPost Media · the desk · newsletterGlossaryNo search logging