Most Popular ShinyHunters 2026 Detection: Salesforce Experience Cloud Guest User Mass Object Access via AuraInspector Exploitation

Ibrahim Saud@tektrix

•updated 6 days ago•0•0•0

Detects unauthenticated guest users abusing the Salesforce Experience Cloud Aura endpoint (/s/sfsites/aura) to perform high-volume metadata and schema enumeration. This activity typically involves tools like AuraInspector to harvest CRM data by repeatedly invoking Aura actions such as describeSObjects, getSObjectMetadata, ObjectInfoController, or RecordUiController.