🛑Threat actors are mass-scanning #Salesforce Experience Cloud sites using AuraInspector.

The tool probes the /s/sfsites/aura API and can extract CRM data if guest user permissions are too broad. Salesforce says the platform isn’t vulnerable—misconfiguration is the risk.

🔗 Read → https://thehackernews.com/2026/03/threat-actors-mass-scan-salesforce.html

🚨 Hackers spent a year stealing data from #Salesforce environments without exploiting a single platform flaw.

#Microsoft mapped the ShinyHunters-linked activity to trusted OAuth apps, stolen vendor tokens, and misconfigured guest access while sign-in monitoring stayed quiet.

How the three attack paths worked: https://thehackernews.com/2026/07/microsoft-maps-year-long-shinyhunters.html