ShinyHunters Turned a Security Tool Into a Weapon

Mandiant releases audit tool in January. ShinyHunters weaponizes it by March. 400 companies breached. Including a cybersecurity company called Aura.

State of Surveillance Editorial Team

TL;DR: ShinyHunters took a legitimate security audit tool released by Google-owned Mandiant in January 2026 and turned it into a data extraction weapon. They used the modified tool to scan and exploit Salesforce Experience Cloud sites with misconfigured guest user permissions. The result: 300-400 companies breached, including (in a twist of painful irony) the cybersecurity company Aura.com. Salesforce says this isn't a platform vulnerability, just customer misconfiguration. That distinction won't matter to the millions of people whose data just got stolen.

The Tool That Became a Weapon

In January 2026, Mandiant (now part of Google Cloud) released AuraInspector, an open-source tool designed to help Salesforce administrators find access control misconfigurations in the Aura framework, the component that powers Salesforce Experience Cloud customer portals.[1]

It was supposed to help defenders. Security teams could scan their own Salesforce implementations, find overly permissive guest user settings, and fix them before attackers did.

ShinyHunters had other plans.

By late February, the group had modified AuraInspector to go beyond mere identification. Their version didn't just find misconfigurations: it exploited them to extract data at scale.[2]

How the Attack Works

The vulnerability isn't in Salesforce itself. It's in how customers configure their Experience Cloud sites. When guest user permissions are set too permissively, unauthenticated attackers can:

  1. Hit the /s/sfsites/aura API endpoint without logging in
  2. Execute queries against the Salesforce Aura framework
  3. Bypass the standard 2,000-record retrieval limit by manipulating the sortBy parameter
  4. Use GraphQL Aura controllers to exfiltrate entire databases

ShinyHunters' weaponized version of AuraInspector automated this process. Point it at a target, let it scan, watch the data flow out.[3]

The group started this campaign back in September 2025, quietly compromising companies one by one. When Mandiant released AuraInspector in January, they modified the code for faster reconnaissance. By March, they'd hit hundreds of targets.

The Cybersecurity Company Got Owned

One of the confirmed victims is Aura.com, a digital security company that sells identity theft protection services.[4]

Let that sink in for a moment.

On March 12, ShinyHunters named Aura.com on their leak site after the company failed to meet extortion demands. Two days later, they released the stolen data: 921,000 email records from Aura's Salesforce CRM database.[5]

A company that sells protection against data breaches. Breached. Because of a misconfigured Salesforce portal. Using a tool named after the framework their portal ran on.

The irony writes itself.

300-400 Companies and Counting

ShinyHunters told reporters they've breached "several hundred" companies in this campaign. Estimates range from 300 to 400 organizations globally, with around 100 described as "high-profile."[2][6]

Many victims are in the cybersecurity sector. Others span healthcare, finance, retail, and education. The group's extortion playbook is familiar: pay up or get published.

Messages to victims read: "Please consider this a preliminary warning before we release your name with FINAL WARNING or a complete data leak."[7]

Salesforce: It's a Configuration Problem, Not Us

Salesforce issued a customer alert in March 2026, but made its position clear: this isn't a platform vulnerability.[8]

"Salesforce has not identified any vulnerability inherent to the Salesforce platform associated with this activity. These attempts are focused on customer configuration settings that, if not properly secured, may increase exposure."

Translation: you didn't configure your stuff right, and that's on you.

They're technically correct. The Aura framework works as designed. Guest users can query data if you give them permission. The problem is that many organizations don't realize what permissions they've granted.

If You Use Salesforce Experience Cloud

Salesforce recommends these immediate actions:[8]

  • Check guest user settings: Review what guest users can access in your Experience Cloud sites
  • Set Default External Access to Private: For all objects, make sure external access defaults to private
  • Disable public API access for guests: Unless absolutely necessary, block API access for unauthenticated users
  • Restrict visibility settings: Prevent guest users from enumerating internal organization members
  • Disable self-registration: If you don't need it, turn it off
  • Monitor logs: Look for unusual queries hitting the /s/sfsites/aura endpoint

The RH-ISAC (Retail & Hospitality Information Sharing and Analysis Center) published indicators of compromise for this campaign.[9] If you run Salesforce, your security team should be looking for these patterns.

Security Tools Get Weaponized. Again.

This isn't the first time attackers have turned defensive tools into offensive weapons. Cobalt Strike, Metasploit, PowerShell Empire: tools built for red teams and security researchers routinely end up in threat actor arsenals.

AuraInspector is the latest example. Mandiant built it to help defenders find problems before attackers did. ShinyHunters found the problems first.

The security industry has debated this for years. Releasing vulnerability research helps defenders patch faster. But it also gives attackers a roadmap. There's no clean answer.

What's clear: if you're using Salesforce Experience Cloud, assume someone has already scanned your configuration. Check your guest user settings. Do it today.

ShinyHunters' 2026 Campaign

This Salesforce campaign is running parallel to ShinyHunters' ongoing Okta vishing attacks. The group has been busy:

Different attack vectors, same result: massive data theft followed by extortion demands. French authorities arrested one ShinyHunters member in 2024, but the group keeps operating.

If You're a Consumer

If you've interacted with companies that use Salesforce Experience Cloud for customer portals (which is a lot of companies), your data may have been exposed. The problem is you have no way to know which specific companies got hit.

  • Check Have I Been Pwned: Some ShinyHunters breaches are already in the database
  • Watch for breach notifications: Affected companies should be notifying victims in the coming weeks
  • Be skeptical of "customer service" contacts: Stolen CRM data means attackers know your account details and interaction history
  • Enable 2FA everywhere: Especially on accounts with financial data

References

  1. The Hacker News: Threat Actors Mass-Scan Salesforce Experience Cloud via Modified AuraInspector Tool (March 2026)
  2. Bleeping Computer: ShinyHunters claims ongoing Salesforce Aura data theft attacks
  3. Reco: Inside the ShinyHunters Experience Cloud Campaign: IOCs, Detection Logic, and What's at Risk
  4. DataBreach.com: Aura.com 2026 Breach
  5. Help Net Security: ShinyHunters claims new campaign targeting Salesforce Experience Cloud sites (March 11, 2026)
  6. Salesforce Ben: ShinyHunters Breach 400 Companies via Salesforce Experience Cloud
  7. Cyber Insider: ShinyHunters claims hundreds of victims in new Salesforce Aura campaign
  8. IT Pro: Salesforce issues customer alert as ShinyHunters group claims Experience Cloud breach
  9. RH-ISAC: ShinyHunters Utilize Public Audit Tool to Scan for Vulnerable Salesforce Aura Instances

Published: March 18, 2026