ShinyHunters claims ongoing Salesforce Aura data theft attacks

Salesforce warns that attackers are scanning and exploiting misconfigured Experience Cloud (Aura) guest-user settings—via the /s/sfsites/aura endpoint and modified AuraInspector—to directly query and steal CRM data. The ShinyHunters group claims responsibility for mass compromises of hundreds of organizations, describes techniques to bypass GraphQL record limits, and shares custom user-agents; Salesforce emphasizes this stems from customer configuration issues and provides immediate mitigation steps (audit guest permissions, disable API access for guest profiles, enforce least privilege).