Icarus is an extortion group active since April 28, 2026, responsible for compromising Klue's integration infrastructure and exfiltrating customer data via OAuth token abuse. The group has claimed two victims and listed stolen data on a leak site hosted on PROSPERO infrastructure.