What Happened
On March 10, 2026, Salesforce confirmed that attackers were exploiting publicly accessible or improperly configured Salesforce Experience Cloud portals. The activity has been attributed to the ShinyHunters threat group.
Salesforce clarified that the issue does not originate from a security defect in the platform. Instead, the exposure occurs when guest user profiles within Experience Cloud environments are configured with overly permissive access rights, allowing unintended visibility into internal CRM data.
How Experience Cloud’s Guest User Model Works — and Where It Breaks
Salesforce Experience Cloud enables organizations to build external portals that connect customers, partners, and other outside users to CRM services. These portals rely on a guest user profile that processes requests from users who have not authenticated.
When the guest profile is configured correctly, access is tightly restricted. However, if administrators inadvertently allow broad API permissions or object-level access, an unauthenticated party may be able to query CRM data without logging in.
Attackers focused on the /s/sfsites/aura API endpoint, which is used by Salesforce’s Aura frontend framework to retrieve backend data through server-side controller calls. If the guest user profile allows excessive privileges, this endpoint can effectively expose internal records to unauthenticated queries.
The Weaponized Tool: AuraInspector
A key technical component of the campaign is a modified version of AuraInspector, an open-source command-line tool created by Mandiant, Google’s threat intelligence and incident response organization. Mandiant released AuraInspector on January 13, 2026, as a defensive auditing utility designed to help administrators detect risky configurations in Aura-based environments. The tool checks for issues such as:
- Excessive permissions assigned to guest user profiles
- Improperly enabled self-registration features
- Unauthorized access to administrative interfaces
Importantly, the public version of AuraInspector intentionally excluded functionality for extracting data, a design choice meant to prevent misuse.
ShinyHunters reportedly reverse-engineered and modified the tool, adding record extraction capabilities and transforming a defensive auditing tool into an offensive scanning framework. Using the modified utility, the group scanned the internet for Experience Cloud deployments and tested the /s/sfsites/aura endpoint for guest-access misconfigurations.
Another obstacle involved Salesforce’s GraphQL query limit of 2,000 records per request. The attackers bypassed this limitation by manipulating the sortBy parameter, alternating between ascending and descending ordering to retrieve additional result sets. They combined this with cursor-based pagination, enabling them to enumerate all records associated with a targeted data object across multiple query cycles.
Mandiant CTO Charles Carmakal confirmed that the defensive tool had been repurposed and indicated that Mandiant is working with Salesforce and affected customers to develop telemetry and detection capabilities. He also noted that evidence of scanning activity in logs does not necessarily indicate that data was successfully compromised.
Scope and Impact
According to statements attributed to the group, ShinyHunters claims to have extracted data from more than 400 websites and approximately 100 high-profile organizations, including companies such as Snowflake, LastPass, Okta, AMD, and Salesforce itself.
The attackers reportedly began targeting organizations with insecure Experience Cloud configurations as early as September 2025, adopting the modified AuraInspector tool shortly after its public release in January 2026.
The exposed datasets typically contain personally identifiable information (PII) such as names and phone numbers. Such information can be leveraged for subsequent targeted phishing or voice-based social engineering campaigns (vishing).
As with many previous ShinyHunters operations, the group appears to be employing its established extortion model: organizations are pressured to pay in exchange for preventing publication of the stolen data on dark-web leak platforms.
Security analysts observing the campaign emphasize that the issue highlights a broader operational challenge. When a publicly accessible interface is paired with excessive permissions, attackers may not require credentials or exploitation techniques — access may already be available by design.
What Salesforce Customers Must Do Now
Salesforce has issued a security advisory outlining mitigation steps for organizations operating Experience Cloud portals.
The most urgent measure is disabling unauthenticated API access by unchecking the option “Allow guest users to access public APIs” and removing the “API Enabled” permission from the guest user profile.
Additional recommended hardening actions include:
- Audit guest user permissions
Navigate to Setup → All Sites → [Your Site] → Builder → Settings → General → Guest User Profile and remove unnecessary object and field permissions that are not required for public visitors. - Set external sharing defaults to Private
Within Setup → Sharing Settings, configure objects so that the default external access level is Private, preventing unintended public exposure. - Disable self-registration when not required
If enabled, self-registration features may allow attackers to escalate access from unauthenticated users to portal accounts. - Analyze Aura Event Monitoring logs
Administrators should review logs for suspicious patterns such as queries against non-public objects, abnormal spikes in requests from unfamiliar IP addresses, or API activity outside expected operational hours.
ShinyHunters’ History with Salesforce
This campaign is not the first instance of ShinyHunters targeting organizations using Salesforce infrastructure. The group has previously conducted operations involving Salesforce ecosystems through compromised third-party integrations and connected applications, including services such as Salesloft, Drift, and Gainsight.
The current campaign demonstrates an evolution in the group’s tactics. Rather than relying primarily on credential theft or OAuth abuse, the attackers have shifted toward automated detection of misconfigurations across large numbers of public portals.
The broader takeaway is architectural. At scale, a configuration weakness can produce consequences similar to those of a software vulnerability. When a security auditing tool designed to identify exposure can be rapidly modified into a scanning engine, the interval between defensive.