Threat actors use custom AuraInspector to harvest data from Salesforce systems

Attackers are mass-scanning public Salesforce Experience Cloud sites using a modified AuraInspector tool to exploit overly permissive guest user settings and extract CRM data (e.g., Accounts, Contacts, Leads). Salesforce characterizes this as exploitation of customer misconfigurations (not a platform vulnerability), attributes activity to a likely threat actor (possibly ShinyHunters), and recommends securing guest user settings, disabling unnecessary APIs, and monitoring logs.