Salesforce Warns of ShinyHunters Campaign Targeting Experience Cloud

Salesforce has issued an urgent warning to customers using its Experience Cloud platform, alerting them to a cybercrime campaign that exploits misconfigured guest user settings to steal sensitive data from public portals. The company disclosed the threat in a blog post on March 7, emphasizing that attackers have targeted hundreds of organizations worldwide through these configurations, leading to potential data breaches and extortion attempts.

The campaign, claimed by the cybercrime group ShinyHunters, involves mass scanning of publicly accessible Experience Cloud sites. Salesforce's Cyber Security Operations Center has been monitoring the activity, which relies on a modified version of the open-source tool Aura Inspector. Originally developed by Mandiant to audit Salesforce Aura instances for data exposure risks, the tool in its altered form probes the ssfsitesaura API endpoint to identify and extract CRM data, such as names, phone numbers, and contact details, without requiring authentication.

ShinyHunters, posting screenshots on its leak site hours after Salesforce's advisory, dubbed the operation the "Salesforce Aura Campaign." The group asserted it had compromised around...