Salesforce Customers Targeted in Data Theft Campaign via Misconfigured Experience Cloud Sites Salesforce has issued a warning about hackers exploiting misconfigured Experience Cloud platforms, which inadvertently grant guest users excessive data access. The ShinyHunters extortion gang claims responsibility, alleging they’ve compromised 300–400 organizations, including around 100 high-profile cybersecurity firms, since September 2025. Attackers are targeting the /s/sfsites/aura API endpoint, leveraging a modified version of AuraInspector an open-source auditing tool developed by Mandiant to scan for misconfigured instances. Salesforce emphasizes that the issue stems from customer-configured guest user permissions, not a platform vulnerability, and advises organizations to audit and restrict guest access to the principle of least privilege. Key mitigation steps include: - Disabling guest access to public APIs and removing the API Enabled setting from guest profiles. - Setting org-wide defaults to Private for external access. - Disabling Portal User Visibility and Site User Visibility to prevent user enumeration. - Reviewing Aura Event Monitoring logs for suspicious activity. ShinyHunters claims to have bypassed Salesforce’s 2,000-record query limit using a sortBy parameter trick, though Salesforce reportedly patched this over the weekend. The group also alleges discovering a new method to extract data from properly configured instances, though this remains unconfirmed. Their custom tool, "RapeForceV2.01.39," mimics the naming convention of their previous "RapeFlake" tool used in Snowflake attacks. Salesforce maintains that no platform vulnerability exists, but Mandiant confirms attackers are misusing AuraInspector for reconnaissance. The company recommends designating a Security Contact for rapid notifications and monitoring for unusual access patterns. ShinyHunters suggests disabling Public Access as a potential defense, though this would convert sites into private portals.