Loading story…
Salesforce warned of increased threat activity targeting publicly accessible Experience Cloud sites where guest user profiles are misconfigured with overly permissive access, enabling unauthenticated users to query and exfiltrate Salesforce CRM data via the Aura framework’s exposed API endpoints (notably /s/sfsites/aura). Salesforce stated it has not identified an inherent platform vulnerability, attributing the risk to customer configuration—specifically excessive permissions granted to the Experience Cloud guest user profile.
Salesforce said attackers are using a modified version of AuraInspector—an open-source auditing tool released by Mandiant—to move beyond identifying exposed objects to mass scanning and data extraction from affected sites. Separately, ShinyHunters publicly claimed it is conducting ongoing data-theft activity and characterized the issue as a “new bug,” while Salesforce reiterated the activity is driven by misconfiguration and issued mitigation guidance emphasizing least privilege, auditing guest permissions, and high-impact hardening such as disabling guest access to public APIs and removing the API Enabled permission from the guest profile.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
By March 10, 2026, Salesforce publicly confirmed that ShinyHunters was the threat group behind the ongoing attacks against misconfigured Experience Cloud sites. The company reiterated that the campaign relied on excessive guest-user permissions rather than a core platform flaw.
Around the time of Salesforce's warning, ShinyHunters publicly claimed responsibility for the campaign and said it had compromised roughly 100 to 400 organizations, including cybersecurity firms, through exposed Experience Cloud instances. The group also used leak-site and extortion messaging to pressure affected organizations, but the victim counts were unverified.
Salesforce disclosed that attackers were abusing the /s/sfsites/aura endpoint and using a customized AuraInspector tool to mass-scan and query exposed CRM objects on misconfigured sites. Mandiant said it was working with Salesforce and customers on telemetry and detection rules and cautioned that evidence of scanning does not necessarily mean a site was breached.
On March 10, 2026, Salesforce issued a security alert that threat actors were actively targeting publicly accessible Experience Cloud sites with overly permissive guest-user settings. The company said the issue was caused by customer misconfiguration rather than an inherent Salesforce platform vulnerability and urged customers to harden guest access immediately.
ShinyHunters said it started using a modified version of Mandiant's open-source AuraInspector in January 2026 to scan public Experience Cloud sites and extract data through exposed Aura API endpoints. Mandiant later confirmed threat actors were misusing AuraInspector for scanning, though scan activity alone did not prove compromise.
ShinyHunters claimed it had been abusing overly permissive guest-user configurations on public Salesforce Experience Cloud sites since September 2025 to access CRM data without authentication. This start date comes from the group's own statements and was not independently verified.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
15 references tracked. Mallory keeps watching after this page renders.
cyberscoop.com
Open sourcehelpnetsecurity.com
Open sourcecsoonline.com
Open sourcescworld.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcebleepingcomputer.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google’s **Mandiant** released **AuraInspector**, an open-source command-line tool designed to identify **access-control misconfigurations** in Salesforce **Experience Cloud** deployments that use the **Aura framework** (part of Salesforce’s Lightning Experience). The tool targets the **Aura endpoint**, a commonly attacked surface in Experience Cloud applications, where complex, multi-layered Salesforce permission and object-sharing configurations can lead to unintended data exposure to external or even unauthenticated users. AuraInspector automates external-style testing of Aura endpoints to surface excessive data access paths and provide remediation guidance. Reported capabilities include automatic Aura endpoint discovery, object/record access scanning, exposed record list discovery (including URLs), checks for self-registration enablement, and techniques to retrieve larger datasets (e.g., a **GraphQL-based** method to fetch more than 2,000 records and “action bulking” to send multiple actions in one request). It inspects responses from Aura methods such as `getItems` and `getConfigData` to detect overexposure of sensitive records (e.g., payment data, identity documents, health information) and is available on GitHub in a read-only mode intended to avoid making changes to target environments.
Jun 29, 2026
Researchers have identified a stealthy campaign dubbed **City-Forum** that is harvesting data from **Salesforce Experience Cloud** sites and **ServiceNow Service Portals** by abusing overly permissive anonymous guest access rather than exploiting a platform vulnerability. The activity has reportedly been ongoing since at least March 2025 and has targeted organizations in telecommunications, banking and financial services, enterprise software, and the public sector. Investigators said the actor uses a custom multi-platform toolset, including a single Go-based binary, to enumerate Salesforce Aura, Lightning Web Runtime, and ServiceNow environments and exfiltrate information that victims had already exposed to unauthenticated users. The campaign is notable for what researchers described as the first observed in-the-wild exploitation of Salesforce's **UI-API guest surface**, including GraphQL-based queries across versions `v56.0` to `v66.0`, while ServiceNow targeting includes the undocumented `/api/now/sp/search` endpoint to retrieve readable knowledge base and catalog content. Activity was tied to the IP address `158.220.87.79`, associated with `city-forum.com`, with requests reportedly using the `Go-http-client/1.1` user agent from a Contabo-hosted VPS in Germany. Researchers said they found no evidence of a breach in Salesforce or ServiceNow themselves, but warned that misconfigurations such as self-registration and excessive guest permissions could allow broader access and urged defenders to audit public portals, restrict guest capabilities, and review logs for the identified indicators.
Aug 13, 2026
A series of extortion attacks have targeted organizations using Salesforce, resulting in the leakage of millions of records. Attackers have exploited vulnerabilities or misconfigurations in Salesforce environments to gain unauthorized access to sensitive customer and business data. Once inside, the threat actors exfiltrated large volumes of information, which they then used as leverage in extortion attempts against the affected companies. The attackers threatened to publicly release or sell the stolen data unless their demands were met, putting significant pressure on the victim organizations. Security experts have highlighted that these incidents demonstrate the growing risk of supply chain and third-party platform attacks, as Salesforce is widely used across industries for customer relationship management. The attacks have raised concerns about the adequacy of security controls and monitoring within cloud-based SaaS platforms, especially when organizations rely heavily on default configurations. In response, security professionals have urged companies to review their Salesforce security settings, implement robust access controls, and monitor for unusual activity. The incidents have also prompted calls for better incident response planning, as organizations must be prepared to act quickly in the event of a breach involving critical business platforms. The extortion group responsible for these attacks has demonstrated technical sophistication, leveraging both technical exploits and social engineering tactics to maximize their impact. The exposure of millions of records has potential regulatory and reputational consequences for the affected organizations, particularly in jurisdictions with strict data protection laws. Security podcasts and news outlets have discussed the technical details of the attacks, the methods used by the extortionists, and the broader implications for cloud security. Experts have also noted that these attacks may inspire copycat incidents targeting other SaaS providers. The events underscore the importance of regular security assessments and employee training to defend against evolving threats. Organizations are advised to stay informed about emerging attack techniques and to collaborate with their SaaS vendors to ensure comprehensive security coverage. The Salesforce extortion attacks serve as a stark reminder of the risks associated with cloud service dependencies and the need for proactive cybersecurity measures.
Jun 29, 2026