Related Threat Clusters
-
City-Forum Campaign Targets Salesforce and ServiceNow Data Exposures
The City-Forum campaign has been actively stealing data from Salesforce and ServiceNow portals since March 2025. Researchers at Reco have identified that the threat actor utilizes custom tools to exploit overly…
7 articles · Updated August 12, 2026 -
Custom AuraInspector Tool Exploits Salesforce Experience Cloud Misconfigurations
Threat actors are conducting mass scans of Salesforce Experience Cloud sites using a modified AuraInspector tool to exploit misconfigurations and access sensitive data. Salesforce's Cyber Security Operations Center…
1 article · Updated March 10, 2026 -
Salesforce Alerts Customers of Experience Cloud Breach by ShinyHunters Group
Salesforce has issued an alert regarding a potential breach of its Experience Cloud, claimed by the ShinyHunters group. The threat actors are reportedly using a modified version of the AuraInspector tool, raising…
1 article · Updated March 10, 2026 -
Mandiant Releases AuraInspector Tool for Salesforce Access Control Auditing
Mandiant has launched AuraInspector, an open-source command line tool aimed at identifying access control misconfigurations in Salesforce environments. The tool automates the detection of configuration errors that have…
2 articles · Updated January 13, 2026
Recent Intelligence Reports
- Mystery attacker spent a year raiding Salesforce and ServiceNow portals — Theregister · August 13, 2026
- Threat actors use custom AuraInspector to harvest data from Salesforce systems — Securityaffairs.Co · March 10, 2026
- Salesforce issues customer alert as ShinyHunters group claims Experience Cloud breach — Itpro · March 10, 2026
- AuraInspector: Auditing Salesforce Aura for Data Exposure — Mandiant · January 12, 2026