Related Threat Clusters
-
City-Forum Campaign Targets Salesforce and ServiceNow Data Exposures
The City-Forum campaign has been actively stealing data from Salesforce and ServiceNow portals since March 2025. Researchers at Reco have identified that the threat actor utilizes custom tools to exploit overly…
7 articles · Updated August 12, 2026 -
Custom AuraInspector Tool Exploits Salesforce Experience Cloud Misconfigurations
Threat actors are conducting mass scans of Salesforce Experience Cloud sites using a modified AuraInspector tool to exploit misconfigurations and access sensitive data. Salesforce's Cyber Security Operations Center…
1 article · Updated March 10, 2026 -
Salesforce Alerts Customers of Experience Cloud Breach by ShinyHunters Group
Salesforce has issued an alert regarding a potential breach of its Experience Cloud, claimed by the ShinyHunters group. The threat actors are reportedly using a modified version of the AuraInspector tool, raising…
1 article · Updated March 10, 2026 -
ShinyHunters Target SSO Accounts in Voice Phishing Attacks
The ShinyHunters extortion gang has claimed responsibility for a series of voice phishing attacks targeting single sign-on (SSO) accounts at major platforms including Okta, Microsoft, and Google. In these attacks,…
191 articles · Updated January 25, 2026 -
Mandiant Releases AuraInspector Tool for Salesforce Access Control Auditing
Mandiant has launched AuraInspector, an open-source command line tool aimed at identifying access control misconfigurations in Salesforce environments. The tool automates the detection of configuration errors that have…
2 articles · Updated January 13, 2026 -
Mandiant Releases AuraInspector to Address Salesforce Misconfigurations
Mandiant has launched AuraInspector, an open source tool designed to help Salesforce administrators identify misconfigurations that may expose sensitive data. The tool specifically targets access control issues within…
2 articles · Updated January 13, 2026
Recent Intelligence Reports
- "City-Forum" data-theft attacks target Salesforce, ServiceNow portals — Bleepingcomputer · August 12, 2026
- ShinyHunters Salesforce Exploit Impacts Snowflake, Okta, Salesforce, More — Technadu · March 10, 2026
- Salesforce Experience Cloud misconfigurations exploited by ShinyHunters | brief — Scworld · March 10, 2026
- Threat actors use custom AuraInspector to harvest data from Salesforce systems — Securityaffairs.Co · March 10, 2026
- Salesforce issues customer alert as ShinyHunters group claims Experience Cloud breach — Itpro · March 10, 2026
- ShinyHunters claims ongoing Salesforce Aura data theft attacks — Bleepingcomputer · March 9, 2026
- Mandiant open sources tool to prevent leaky Salesforce misconfigs — Theregister · January 13, 2026
- Google's Mandiant releases free Salesforce access control checker — Itnews.Au · January 13, 2026