'Overly Permissive' Salesforce Cloud Configs in the Crosshairs

Salesforce reported that attackers are abusing misconfigured Experience Cloud guest user profiles—using a customized Aura Inspector to mass-scan public sites and directly extract CRM data—leading to multiple data theft and extortion campaigns attributed to financially motivated groups; Salesforce urges customers to audit guest user permissions, set defaults to private, disable unnecessary public APIs and self-registration, and monitor logs to mitigate further compromise.