Recent OTX pulses indicate a significant supply chain security incident impacting LastPass. The attack vector involves the compromise of Klue, a third-party market intelligence platform integrated with LastPass’s Salesforce and Gong environments. An unknown adversary exploited stolen OAuth tokens held by Klue to gain unauthorized access to LastPass's customer relationship management (CRM) data. This breach highlights the risks of third-party vendor access and the abuse of federated authentication mechanisms (OAuth) to move laterally into cloud environments. The primary objective appears to be the exfiltration of sensitive customer PII (names, emails, company data) rather than direct financial theft or ransomware deployment at this stage.

Threat Actor / Malware Profile

Adversary: Unknown (Supply Chain Actor) Malware Families: N/A (Identity-Based Compromise)

Distribution Method: Supply Chain Compromise. The adversary leveraged access to the third-party vendor "Klue" rather than attacking LastPass directly. Initial access to Klue likely involved credential theft or session hijacking, though specific vectors are not disclosed in the pulse.
Payload Behavior: No traditional malware payload was deployed on endpoints. The "payload" in this scenario is the misuse of legitimate API access tokens (OAuth). The actor used these tokens to authenticate directly to Salesforce APIs, bypassing traditional security controls that look for malicious binaries.
C2 Communication: While no explicit C2 infrastructure was detailed in the malware context, the domain baccarat.com.au has been flagged as an associated indicator, potentially serving as a redirector, command server, or staging ground for the initial Klue compromise.
Persistence Mechanism: Persistence was achieved through the possession of long-lived OAuth tokens. As long as the tokens remained valid and unrevoked, the adversary could maintain access to the Salesforce environment without needing further exploitation.
Anti-Analysis: N/A. The attack relied on "living off the land" (using legitimate cloud administration tools and APIs), making traffic analysis and detection difficult without strict cloud monitoring.

IOC Analysis

The provided indicators consist of network infrastructure associated with the campaign.

Domain (baccarat.com.au): This domain is flagged in the OTX pulse. SOC teams should immediately block this domain at the perimeter and inspect proxy logs for any historical communications. It may be linked to the command infrastructure used during the initial compromise of the vendor or a data exfiltration site.
Operational Guidance: IOCs should be ingested into SIEM solutions (e.g., Microsoft Sentinel, Splunk) and EDR systems. Teams should specifically hunt for HTTP/HTTPS connections to this domain originating from non-browser applications or unexpected internal hosts.

Detection Engineering

YAML

---
title: Potential Network Connection to Suspicious Domain - Baccarat.com.au
id: 267a1b3a-0000-0000-0000-000000000000
description: Detects network connections to the domain baccarat.com.au associated with LastPass/Klue supply chain incident
status: experimental
author: Security Arsenal
date: 2026/07/26
references:
    - https://cyberpress.org/lastpass-confirms-customer-crm/
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|contains: 'baccarat.com.au'
    condition: selection
falsepositives:
    - Unknown
level: high
---
title: Potential Browser Credential Dumping Activity
id: 267a1b3a-0000-0000-0000-000000000001
description: Detects processes attempting to dump browser credentials or cookies, often used to steal OAuth tokens
status: experimental
author: Security Arsenal
date: 2026/07/26
references:
    - https://cyberpress.org/lastpass-confirms-customer-crm/
tags:
    - attack.credential_access
    - attack.t1555
logsource:
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
        CommandLine|contains:
            - 'Get-Credential'
            - 'cookie'
            - 'Login Data'
    condition: selection
falsepositives:
    - Administrative scripts
level: medium
---
title: Suspicious Process Access to Salesforce/Gong Related Files
id: 267a1b3a-0000-0000-0000-000000000002
description: Detects unusual processes accessing files related to CRM plugins or tokens
status: experimental
author: Security Arsenal
date: 2026/07/26
logsource:
    category: file_access
detection:
    selection:
        TargetFilename|contains:
            - 'Salesforce'
            - 'Klue'
            - 'Gong'
    filter:
        Image|contains:
            - 'chrome.exe'
            - 'firefox.exe'
            - 'edge.exe'
            - 'explorer.exe'
    condition: selection and not filter
falsepositives:
    - Legitimate CRM application usage
level: low


kql
// Hunt for connections to the suspicious domain
DeviceNetworkEvents
| where RemoteUrl contains "baccarat.com.au"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, InitiatingProcessFileName
| order by Timestamp desc

// Hunt for potential OAuth token theft via PowerShell
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName == "powershell.exe"
| where ProcessCommandLine has "token" or ProcessCommandLine has "oauth"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath


powershell
# IOC Hunt for Baccarat.com.au
$domain = "baccarat.com.au"
Write-Host "Checking DNS cache and Hosts file for $domain..."

# Check Hosts File
$hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Select-String -Path $hostsPath -Pattern $domain -SimpleMatch) {
    Write-Host "[!] WARNING: $domain found in hosts file." -ForegroundColor Red
} else {
    Write-Host "[+] $domain not found in hosts file." -ForegroundColor Green
}

# Check DNS Cache (Requires Admin)
try {
    $dnsCache = Get-DnsClientCache | Where-Object { $_.Entry -like "*$domain*" }
    if ($dnsCache) {
        Write-Host "[!] WARNING: $domain found in DNS Cache." -ForegroundColor Red
        $dnsCache | Format-List
    } else {
        Write-Host "[+] $domain not found in DNS Cache." -ForegroundColor Green
    }
} catch {
    Write-Host "[-] Could not check DNS Cache (Admin rights required)." -ForegroundColor Yellow
}


# Response Priorities

*   **Immediate:** Block the domain `baccarat.com.au` on all web proxies and firewalls. Initiate a hunt for any network connections to this domain in the last 30 days. Revoke all active OAuth sessions associated with the Klue integration within the Salesforce environment.
*   **24h:** Conduct a detailed review of Salesforce access logs for the period surrounding the incident (June 12, 2026 onwards). Identify any data exports or unusual bulk record views attributed to the compromised integration account.
*   **1 week:** Perform a comprehensive audit of all third-party applications (OAuth integrations) connected to the corporate Salesforce and Gong environments. Enforce stricter approval workflows for new third-party integrations and implement token rotation policies for vendor accounts.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Supply Chain Compromise: Klue to LastPass OAuth Token Theft — CRM Data Breach

Threat Actor / Malware Profile

IOC Analysis

Detection Engineering

Related Resources

Is your security operations ready?