Threat Actors Mass-Scan Salesforce Experience Cloud via Modified AuraInspector Tool

Threat actors are actively mass-scanning Salesforce Experience Cloud sites to exploit misconfigurations, leveraging a modified version of the open-source AuraInspector tool. Salesforce has issued a warning regarding this increased activity.

Technical Breakdown:

• Target: Publicly accessible Salesforce Experience Cloud sites.
• TTPs:
  • Threat actors are using a customized version of AuraInspector (an open-source tool) for mass-scanning to identify vulnerable sites.
  • The primary exploitation vector is overly permissive Experience Cloud guest user configurations.
  • The ultimate goal is to obtain unauthorized access to sensitive customer data by exploiting these misconfigurations.
• Impact: Unauthorized access to sensitive information through guest user accounts that possess excessive privileges.

Defense:

• Strict Guest User Permissions: Urgently audit and restrict guest user profiles and sharing settings across all Salesforce Experience Cloud sites. Ensure adherence to the principle of least privilege.
• Proactive Configuration Review: Regularly review your Experience Cloud site configurations against Salesforce security best practices to identify and remediate potential misconfigurations.
• Monitor for Anomalies: Implement logging and monitoring for unusual activity, particularly concerning guest user access or unexpected data access patterns on your Experience Cloud sites.

Source: https://thehackernews.com/2026/03/threat-actors-mass-scan-salesforce.html