Threat Actors Mass-Scan Salesforce Experience Cloud via Modified AuraInspector Tool

Salesforce warns of threat actors mass-scanning Experience Cloud sites using a modified version of the open-source AuraInspector tool to exploit misconfigured guest user settings.

• •The original AuraInspector (released by Mandiant in January 2026) identifies vulnerable objects by probing /s/sfsites/aura API endpoints; the modified version goes further by actively extracting data.
• •Attacks exploit overly permissive Experience Cloud guest user profiles, allowing unauthenticated access to Salesforce CRM objects without login.
• •Two conditions must be met for exploitation: use of the guest user profile and failure to follow Salesforce's recommended configuration guidance.
• •Salesforce attributed the campaign to a known threat actor group, with ShinyHunters (UNC6240) suspected; they claimed to have breached "several hundred" companies.