Loading story…
Threat actors have exploited overly permissive anonymous-user settings in publicly accessible Salesforce Experience Cloud environments to retrieve data through the /s/sfsites/aura endpoint. A modified version of the open-source Aura Inspector tool has been used to mass-scan sites and extract records where guest permissions permit access; exposed names and phone numbers can support subsequent phishing and vishing. Salesforce says the platform is not itself vulnerable—the exposure results from customer configuration—and Dutch authorities reported that these campaigns affected misconfigured environments from late 2025 into early 2026.
Researchers also identified multiple Mendix low-code applications with excessive rights assigned to anonymous or newly registered users. Automated scans and legitimate platform requests can collect sensitive data from such deployments, potentially enabling extortion; McGraw-Hill was cited publicly as an example in April 2026. Organizations should inventory internet-facing applications and access rights, enforce least privilege and private defaults, remove unnecessary anonymous access and self-registration, require MFA for administrators, and centralize logging and behavior-based detection for abnormal API activity.
Map this exposure pattern across your cloud, code, and identities.
6 events from the most recent confirmed update back to the earliest known activity.
McGraw-Hill was reportedly extorted after a misconfiguration exposed personal data, with attackers threatening to publish the information unless a ransom was paid.
DIVD announced that a large-scale scan had identified multiple misconfigured Mendix applications with excessive permissions for anonymous or newly registered users. Exposed information included names, contact details, addresses, customer data, and identity documents.
Mandiant published AuraInspector, an open-source tool intended to help Salesforce administrators identify Experience Cloud configuration errors.
Threat actors abused overly permissive guest-user configurations in Salesforce Experience Cloud environments, allowing unauthenticated queries through the Aura API. Salesforce said the exposure resulted from customer configuration errors rather than a platform vulnerability.
DIVD began investigating authorization misconfigurations in applications built on the Mendix low-code platform. The investigation focused on applications granting excessive access to anonymous or newly registered users.
Attackers began using a modified AuraInspector to mass-scan public Salesforce Experience Cloud sites via the /s/sfsites/aura endpoint and extract data where guest permissions permitted access. The responsible group claimed to have affected between 300 and 400 organizations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
ncsc.nl
Open sourcesalesforce.com
Open sourcedivd.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Salesforce warned of increased threat activity targeting **publicly accessible Experience Cloud** sites where **guest user profiles** are misconfigured with overly permissive access, enabling unauthenticated users to query and exfiltrate Salesforce CRM data via the Aura framework’s exposed API endpoints (notably `/s/sfsites/aura`). Salesforce stated it has **not identified an inherent platform vulnerability**, attributing the risk to customer configuration—specifically excessive permissions granted to the Experience Cloud guest user profile. Salesforce said attackers are using a **modified version of *AuraInspector***—an open-source auditing tool released by Mandiant—to move beyond identifying exposed objects to **mass scanning and data extraction** from affected sites. Separately, **ShinyHunters** publicly claimed it is conducting ongoing data-theft activity and characterized the issue as a “new bug,” while Salesforce reiterated the activity is driven by misconfiguration and issued mitigation guidance emphasizing least privilege, auditing guest permissions, and high-impact hardening such as **disabling guest access to public APIs** and removing the **`API Enabled`** permission from the guest profile.
Jun 29, 2026
Researchers have identified a stealthy campaign dubbed **City-Forum** that is harvesting data from **Salesforce Experience Cloud** sites and **ServiceNow Service Portals** by abusing overly permissive anonymous guest access rather than exploiting a platform vulnerability. The activity has reportedly been ongoing since at least March 2025 and has targeted organizations in telecommunications, banking and financial services, enterprise software, and the public sector. Investigators said the actor uses a custom multi-platform toolset, including a single Go-based binary, to enumerate Salesforce Aura, Lightning Web Runtime, and ServiceNow environments and exfiltrate information that victims had already exposed to unauthenticated users. The campaign is notable for what researchers described as the first observed in-the-wild exploitation of Salesforce's **UI-API guest surface**, including GraphQL-based queries across versions `v56.0` to `v66.0`, while ServiceNow targeting includes the undocumented `/api/now/sp/search` endpoint to retrieve readable knowledge base and catalog content. Activity was tied to the IP address `158.220.87.79`, associated with `city-forum.com`, with requests reportedly using the `Go-http-client/1.1` user agent from a Contabo-hosted VPS in Germany. Researchers said they found no evidence of a breach in Salesforce or ServiceNow themselves, but warned that misconfigurations such as self-registration and excessive guest permissions could allow broader access and urged defenders to audit public portals, restrict guest capabilities, and review logs for the identified indicators.
Aug 14, 2026
Google’s **Mandiant** released **AuraInspector**, an open-source command-line tool designed to identify **access-control misconfigurations** in Salesforce **Experience Cloud** deployments that use the **Aura framework** (part of Salesforce’s Lightning Experience). The tool targets the **Aura endpoint**, a commonly attacked surface in Experience Cloud applications, where complex, multi-layered Salesforce permission and object-sharing configurations can lead to unintended data exposure to external or even unauthenticated users. AuraInspector automates external-style testing of Aura endpoints to surface excessive data access paths and provide remediation guidance. Reported capabilities include automatic Aura endpoint discovery, object/record access scanning, exposed record list discovery (including URLs), checks for self-registration enablement, and techniques to retrieve larger datasets (e.g., a **GraphQL-based** method to fetch more than 2,000 records and “action bulking” to send multiple actions in one request). It inspects responses from Aura methods such as `getItems` and `getConfigData` to detect overexposure of sensitive records (e.g., payment data, identity documents, health information) and is available on GitHub in a read-only mode intended to avoid making changes to target environments.
Jun 29, 2026