Loading story…
Google’s Mandiant released AuraInspector, an open-source command-line tool designed to identify access-control misconfigurations in Salesforce Experience Cloud deployments that use the Aura framework (part of Salesforce’s Lightning Experience). The tool targets the Aura endpoint, a commonly attacked surface in Experience Cloud applications, where complex, multi-layered Salesforce permission and object-sharing configurations can lead to unintended data exposure to external or even unauthenticated users.
AuraInspector automates external-style testing of Aura endpoints to surface excessive data access paths and provide remediation guidance. Reported capabilities include automatic Aura endpoint discovery, object/record access scanning, exposed record list discovery (including URLs), checks for self-registration enablement, and techniques to retrieve larger datasets (e.g., a GraphQL-based method to fetch more than 2,000 records and “action bulking” to send multiple actions in one request). It inspects responses from Aura methods such as getItems and getConfigData to detect overexposure of sensitive records (e.g., payment data, identity documents, health information) and is available on GitHub in a read-only mode intended to avoid making changes to target environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
In conjunction with AuraInspector, Mandiant revealed a previously undocumented technique using Salesforce's GraphQL Aura controller to bypass the standard 2,000-record retrieval limit. The method enables more complete impact assessment when misconfigurations allow unauthorized access to Salesforce data.
Google and Mandiant released AuraInspector, an open-source, read-only command-line tool to audit Salesforce Experience Cloud applications for Aura access-control misconfigurations and unintended data exposure. The tool was made freely available on GitHub to help defenders assess Aura endpoint exposure at scale.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Salesforce warned of increased threat activity targeting **publicly accessible Experience Cloud** sites where **guest user profiles** are misconfigured with overly permissive access, enabling unauthenticated users to query and exfiltrate Salesforce CRM data via the Aura framework’s exposed API endpoints (notably `/s/sfsites/aura`). Salesforce stated it has **not identified an inherent platform vulnerability**, attributing the risk to customer configuration—specifically excessive permissions granted to the Experience Cloud guest user profile. Salesforce said attackers are using a **modified version of *AuraInspector***—an open-source auditing tool released by Mandiant—to move beyond identifying exposed objects to **mass scanning and data extraction** from affected sites. Separately, **ShinyHunters** publicly claimed it is conducting ongoing data-theft activity and characterized the issue as a “new bug,” while Salesforce reiterated the activity is driven by misconfiguration and issued mitigation guidance emphasizing least privilege, auditing guest permissions, and high-impact hardening such as **disabling guest access to public APIs** and removing the **`API Enabled`** permission from the guest profile.
Jun 29, 2026
A significant wave of OAuth-related breaches has recently impacted the Salesforce ecosystem, resulting in the exposure of sensitive data from over 700 organizations and affecting nearly 1.5 billion records. The breaches were not due to a direct compromise of Salesforce itself, but rather stemmed from attackers exploiting weaknesses in third-party OAuth integrations connected to Salesforce environments. At the recent Dreamforce conference, Salesforce emphasized security as a shared responsibility and introduced new AI-driven security and compliance agents, but notably did not address the recent OAuth breach incidents that have led to more than 70 lawsuits. Security experts highlighted this omission, noting that the lessons from these breaches are critical for the future of interconnected, AI-driven business platforms. According to Google Threat Intelligence Group, the attackers systematically exported large volumes of data from numerous corporate Salesforce instances by abusing OAuth tokens. These tokens, which are designed to allow secure, delegated access to cloud applications, were leveraged by threat actors to gain persistent, high-privilege access to customer data. Proofpoint researchers have further warned that attackers are increasingly abusing both external and internal OAuth-based applications to maintain access to cloud environments, even after password resets or the enforcement of multifactor authentication. Internal OAuth applications, which are registered within an organization’s own cloud tenant and typically trusted, can be particularly difficult to detect when compromised. Attackers have developed automated toolkits to register malicious OAuth applications with pre-configured permissions, using compromised admin accounts to escalate privileges and maintain persistence. The breaches underscore the risks inherent in SaaS supply chains, where third-party integrations can become a vector for large-scale data exfiltration. Security professionals stress the importance of monitoring OAuth app permissions, regularly auditing third-party integrations, and educating users about the risks of granting excessive access. The incident has prompted calls for greater transparency and proactive security measures from both SaaS providers and their customers. The scale of the breach and the sophistication of the attack methods highlight the evolving threat landscape facing cloud-based business platforms. Organizations are urged to review their OAuth security posture and implement robust controls to mitigate similar risks in the future. The incident serves as a stark reminder that even trusted cloud environments can be compromised through indirect attack vectors, necessitating a holistic approach to cloud security.
Jun 29, 2026
Researchers have identified a stealthy campaign dubbed **City-Forum** that is harvesting data from **Salesforce Experience Cloud** sites and **ServiceNow Service Portals** by abusing overly permissive anonymous guest access rather than exploiting a platform vulnerability. The activity has reportedly been ongoing since at least March 2025 and has targeted organizations in telecommunications, banking and financial services, enterprise software, and the public sector. Investigators said the actor uses a custom multi-platform toolset, including a single Go-based binary, to enumerate Salesforce Aura, Lightning Web Runtime, and ServiceNow environments and exfiltrate information that victims had already exposed to unauthenticated users. The campaign is notable for what researchers described as the first observed in-the-wild exploitation of Salesforce's **UI-API guest surface**, including GraphQL-based queries across versions `v56.0` to `v66.0`, while ServiceNow targeting includes the undocumented `/api/now/sp/search` endpoint to retrieve readable knowledge base and catalog content. Activity was tied to the IP address `158.220.87.79`, associated with `city-forum.com`, with requests reportedly using the `Go-http-client/1.1` user agent from a Contabo-hosted VPS in Germany. Researchers said they found no evidence of a breach in Salesforce or ServiceNow themselves, but warned that misconfigurations such as self-registration and excessive guest permissions could allow broader access and urged defenders to audit public portals, restrict guest capabilities, and review logs for the identified indicators.
Aug 13, 2026