ShinyHunters Claims Mass Data Theft From Hundreds of Salesforce Customers Using Weaponized Open-Source Tool
The ShinyHunters cybercrime group says it exploited misconfigured Salesforce Experience Cloud guest accounts to steal data from nearly 400 organizations using a modified version of Mandiant's AuraInspector tool.
Overview
Salesforce issued an urgent customer alert over the weekend after the notorious cybercrime group ShinyHunters claimed to have stolen data from nearly 400 organizations by exploiting misconfigured Experience Cloud sites. The attackers used a weaponized version of Mandiant’s open-source AuraInspector tool to scan for and extract data from publicly accessible Salesforce instances whose guest user permissions were set too broadly.
The campaign highlights a persistent tension in cloud security: the vulnerability lies not in the platform itself but in how customers configure it.
What We Know
ShinyHunters, a prolific data theft group previously linked to breaches at Snowflake, AT&T, and Ticketmaster, says it conducted reconnaissance and exploitation over “several months” before going public with its claims. The group alleges it targeted hundreds of Salesforce customers, including roughly 100 high-profile companies, by querying Salesforce CRM objects through the /s/sfsites/aura API endpoint without authentication.
The attack chain centers on Salesforce Experience Cloud, a product that allows organizations to build customer-facing portals, communities, and self-service sites. These sites use guest user profiles to grant unauthenticated visitors limited access to public content. When administrators configure these profiles with overly permissive settings, they inadvertently expose sensitive CRM objects and fields to anyone who knows how to query the Aura framework.
The tool at the heart of the campaign is a modified version of AuraInspector, an open-source auditing utility originally developed by Mandiant to help administrators identify access control misconfigurations within the Salesforce Aura framework. While the legitimate tool only identifies vulnerable objects by probing API endpoints, ShinyHunters built a custom version capable of extracting data at scale, including techniques to bypass the guest user 2,000-record query limit.
The stolen data primarily consists of personally identifiable information, including names and phone numbers, which researchers say is being used to build follow-on social engineering and voice phishing campaigns.
Salesforce has attributed the issue to customer misconfiguration rather than a platform security flaw. The company recommended that customers audit their guest user permissions, restrict external object access to private by default, disable public API access for guest profiles, and implement least-privilege access principles.
What We Don’t Know
Salesforce has not confirmed how many of its customers were actually compromised, and ShinyHunters’ claim of nearly 400 affected organizations has not been independently verified. The specific high-profile victims named by the group have not publicly acknowledged breaches. It also remains unclear whether ShinyHunters has begun selling or leaking the stolen data, or whether the group’s primary goal is extortion.
The timeline of when Salesforce first became aware of the campaign and how long the exploitation window remained open has not been fully disclosed.
Analysis
This campaign follows a pattern that has become increasingly common in cloud security incidents: attackers exploit not a software vulnerability but a configuration gap that sits squarely in the customer’s domain of responsibility. The shared responsibility model that underpins cloud platforms like Salesforce, AWS, and Azure places the burden of access control configuration on the customer, but many organizations lack the specialized knowledge to audit these settings effectively.
The weaponization of Mandiant’s AuraInspector is particularly notable. The tool was designed to help defenders find exactly the kind of misconfiguration that ShinyHunters exploited. Its transformation into an offensive weapon illustrates a recurring dilemma in security tooling: utilities built to surface weaknesses can just as easily be turned against the organizations they were meant to protect.
For Salesforce administrators, the immediate priority is reviewing guest user profiles and ensuring that CRM objects are not inadvertently exposed through Experience Cloud sites. The company’s guidance to disable public API access for guest users and enforce least-privilege settings should be treated as urgent rather than advisory.