ShinyHunters Turns a Mandiant Tool on Salesforce Sites With Loose Guest Permissions
Salesforce warned that a known extortion crew was scanning public Experience Cloud sites, harvesting CRM data that fuels the next round of voice phishing.
Key takeaways
- Salesforce says the issue is misconfigured guest-user profiles, not a platform vulnerability.
- Attackers modified Mandiant's open-source AuraInspector to pull records from over-permissive public sites.
- ShinyHunters claims about 100 companies and nearly 400 websites; the claims are unverified.
ShinyHunters is back in Salesforce customers' data, and this time nobody had to be tricked on the phone first. In early March 2026 Salesforce warned that a known threat actor was scanning public Experience Cloud sites and extracting records from those whose guest-user settings were too generous.
What happened
Salesforce issued its warning on a Saturday, with The Register reporting the story on Monday 9 March. According to the company, the attackers used a modified build of AuraInspector, a free open-source tool that Mandiant released in January 2026. The original probes the /s/sfsites/aura endpoint to find misconfigurations; the altered version goes further and exploits guest profiles with excessive object and field permissions to query CRM data without logging in.
ShinyHunters told The Register that the reconnaissance and exploitation had been under way for several months. It said it built a way around a 2,000-record limit on guest queries and claimed to have taken data from about 100 high-profile companies and nearly 400 websites, naming firms including Snowflake, Okta, LastPass, Sony and AMD. Those are the group's assertions. Salesforce declined to say how many customers were affected, and LastPass said it was aware of the campaign and had seen no evidence tying it to a separate phishing run the week before.
A campaign with a pattern
This is part of a larger 2026 run. Researchers describe a repeatable pipeline in which voice phishing captures single sign-on credentials and the attacker walks into Salesforce, while the guest-profile route needs no victim at all. TechCrunch's year-to-date roundup ties the crew to some of the year's biggest incidents, including roughly 40 million records at Charter Communications, at least 6 million Carnival customers, and more than 30 million people in the Instructure Canvas breach.
Why it matters
Salesforce is right that this is configuration, not a software bug. That is both reassuring and uncomfortable: the fix sits with thousands of customer admins, and public-facing portals are easy to find. The Register noted that ShinyHunters has repeatedly targeted Salesforce customers over the past year and was behind the 2024 Snowflake customer intrusions. Stolen contact data is also raw material for convincing phone scams.
Guest access, explained
Experience Cloud lets organisations build public portals, help centres and partner sites on top of Salesforce data. To show pages to visitors who have not logged in, administrators assign a guest user profile. That profile is supposed to see only what the public page needs. The problem arises when it is granted read access to broad objects and fields, such as accounts, contacts or cases, because a later configuration shortcut or an old integration needed it. The platform will then happily answer queries from any visitor, which is exactly what scanning tools probe for.
Salesforce framed its guidance accordingly: audit guest-user permissions and apply least privilege, set the default external access level for all objects to private, and turn off guest access to public APIs by removing the API Enabled permission from guest profiles. Mandiant's Charles Carmakal cautioned, as The Register relayed, that seeing scanning in logs does not by itself indicate a compromise, so teams should look for actual record retrieval, not just probing.
The campaign also illustrates how data theft and social engineering reinforce each other. Names, phone numbers and organisational details pulled from a CRM are precisely what a caller needs to sound credible when impersonating IT support. Security vendors describe a 2026 playbook in which ShinyHunters-linked actors phone employees, steer them to a fake single sign-on page, and then walk into SaaS tenants with legitimate credentials. The guest-profile route adds a second, quieter lane that needs no human at all. Organisations that rely on Salesforce should therefore review both: who can reach their data anonymously, and how their help desk verifies callers who claim to need a reset or a new device.
What to watch
- Whether Salesforce changes defaults for guest access, rather than relying on customer audits.
- New victims appearing on the group's leak site, and which claims get confirmed.
- Help-desk and SSO call-back procedures, since the follow-on phone attacks are the costly part.
