Threat Actors Mass-Scan Salesforce Experience Cloud via Modified AuraInspector Tool

Salesforce has alerted customers that a threat actor is using a customized version of the open-source AuraInspector tool to mass-scan publicly accessible Experience Cloud sites and extract data by exploiting overly permissive guest user configurations; this activity targets misconfigured guest profiles (not a core platform vulnerability) and has been linked by Salesforce to a known actor with tactics similar to prior attacks, with guidance to tighten guest access, disable guest API access, and monitor logs.