Scope of Salesforce Attacks Expands as Icarus Leaks Data

Multiple high-impact incidents and trending attack techniques appear across the feed: attackers are abusing third-party application OAuth tokens to steal Salesforce customer data (Klue/Battlecards), while a massive FortiGate-focused campaign (FortiBleed/Fortinet credential harvest) has exfiltrated tens of millions of credentials from hundreds of thousands of devices. Supply-chain and developer workflow attacks are rising (malicious pull requests dubbed 'Cordyceps', leaked GitHub tokens, CI/CD risks), alongside active exploitation of high‑severity bugs and zero‑days (Oracle ERP, Ivanti, others)