ShinyHunters Exploit Salesforce Guest Access Misconfigurations

Du'aine Davis

Observed in the wild

• In early March, Salesforce warned that customers running public Experience Cloud sites were being targeted due to over‑permissive guest user configurations. Shortly afterwards, the ShinyHunters extortion group claimed responsibility, stating they had stolen data from around 100 high‑profile organisations, potentially including Salesforce customers, as part of an ongoing campaign. Salesforce reiterated this was a configuration issue, not a platform flaw.
• The attacks involved mass scanning and exploitation of public Experience Cloud sites using a modified version of Mandiant’s Aura Inspector tool. ShinyHunters claimed to abuse the /s/sfsites/aura API endpoint to extract data accessible via misconfigured guest user profiles. The Register reports the activity had been ongoing for months and targeted multiple well‑known brands.
• Salesforce advises customers to audit and minimise guest user permissions, disable unnecessary API access, and restrict object and field‑level visibility. Organisations are advised to monitor for suspicious unauthenticated API usage, unusual IP scanning behaviour, and downstream indicators such as phishing or vishing campaigns leveraging exposed contact data attributed to ShinyHunters activity

Protecting Your Data: Essential Actions to Secure Experience Cloud Guest User Access - Salesforce

ShinyHunters claims yet another Salesforce customers breach • The Register

Du'aine Davis

Klue Supply Chain Breach Enables Salesforce Data Exfiltration
Observed in the wild

• On 18 June, Huntress disclosed that Klue, a market intelligence platform used by multiple cybersecurity firms, had been breached; Klue’s compromise began on 11 June and Huntress staff received extortion emails on 16 June. On 22 June, Icarus listed Huntress and other impacted companies’ data, limited for Huntress to Salesforce CRM/sales data, not products, telemetry, passwords, or payment cards.
• Huntress researchers assess that the actor likely used a long-disused but still active Klue credential, pivoted through Klue backend systems, pushed token-theft code, stole customer OAuth tokens, and queried connected CRM tools directly. Malicious Salesforce requests largely targeted /services/data/v59.0/query/<STRING> with blank, 5238, or Python-urllib/3.12 / 3.14 User-Agents. Huntress assesses with high confidence that Icarus is responsible.
• Impacted organisations are advised to review Klue, Salesforce, Gong and other OAuth-connected application logs against Klue IOCs; revoke active sessions and affected integrations; request missing logs from vendors; preserve extortion emails for forensics; and avoid downloading leaked datasets. In Microsoft Defender XDR, hunt for suspicious email domains, unusual OAuth activity, Salesforce access from listed IPs, anomalous User-Agents, and follow-on phishing using stolen sales context.

Cybercrime Breaches Klue: Salesforce Data Impacted for Many Victims, including Huntress | Huntress