ShinyHunters: Salesforce’s Uninvited Guest User Profile Breach | Mitiga

This report describes how the ShinyHunters cybercriminal group exploited misconfigured Salesforce Experience Cloud Guest User profiles and the public /s/sfsites/aura endpoint—using a modified AuraInspector tool—to mass-scan and exfiltrate CRM records from an estimated 300–400 organizations, with stolen data subsequently used for vishing and identity fraud; the blog includes detection indicators and a prioritized remediation checklist.