Index live· 1,284 files · 148 editions
ForensicPost

Search the index

3 results
Try
Results for “Stolen OAuth tokens”Newest first
26-0611
File

Klue Compromise Reached Salesforce Environments at Two Dozen Customers

A legacy credential and stolen OAuth tokens reached Salesforce environments at ~24 customers. The tokens were used exactly as designed.

UnattributedOAuth token theftCloudTokens
Sev 4TargetKlueActorUnattributed
25-0818
File

One Integration, Seven Hundred Customer Environments

700+ organisations queried through one integration’s stolen tokens. Nothing was exploited; the tokens worked exactly as designed.

UNC6395OAuth token theftCloudTokens
Sev 5TargetSalesloft Drift integrationActorUNC6395
22-0412
File

GitHub Says Stolen Heroku and Travis-CI Tokens Exposed Private Repositories at Dozens of Organisations

The security of a system is the security of everyone it has delegated to — a set nobody enumerates.

UnattributedStolen OAuth tokensTechnologySupply chain
Sev 4TargetGitHub customers, incl. npmActorUnattributedUSA
ForensicPost

Independent reporting on digital forensics and incident response.

SectionsBreachesRansomwareNation-stateCloud
DataCase filesData exportActor indexGlossaryMethodology
ContactSecure tipsCorrectionsThe deskEthics
© 2026 ForensicPost Media · the desk · newsletterGlossaryNo search logging