Back Scworld

Salesforce Experience Cloud misconfigurations exploited by ShinyHunters | brief

Scworld • March 10, 2026

Salesforce is alerting customers to a security issue affecting misconfigured Experience Cloud platforms, where hackers are exploiting guest accounts to access sensitive data. The ShinyHunters extortion gang claims responsibility for actively exploiting exposed instances to steal data, as reported by Bleeping Computer.

Attackers are leveraging a modified version of the open-source AuraInspector tool to target the /s/sfsites/aura API endpoint on misconfigured Salesforce Experience Cloud instances. This misconfiguration allows guest users unintended access to more data than they should have access to. Salesforce emphasizes that this is not a platform vulnerability but a result of customer-configured guest user settings granting excessive permissions.

The ShinyHunters gang claims to have compromised between 300 and 400 organizations, many in the cybersecurity sector, by exploiting these access control weaknesses. They reportedly found ways to bypass data query limitations, accelerating data theft.

Source: Bleeping Computer

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ShinyHunters Target SSO Accounts in Voice Phishing Attacks The ShinyHunters extortion gang has claimed responsibility for a series of voice phishing attacks targeting single sign-on (SSO) accounts at major platforms including Okta, Microsoft, and Google. In these attacks, threat actors impersonate IT support to trick employees into providing their credentials and multi-factor authentication codes, enabling access to corporate SaaS platforms and potential data theft for extortion purposes. 191 sources 51

Extracted Entities

Salesforce Experience Cloud misconfigurations exploited by ShinyHunters | brief

The full story

Extracted Entities

Attack Types (1)

Platforms (1)

Tools (1)