New Hacker Tool Targets Millions Of Major Business Websites

Silicon Valley insiders report New Hacker Tool Targets Millions Of Major Business Websites, according to The Hacker News (@TheHackersNews) (in the last 24 hours).

Source: https://x.com/TheHackersNews/status/2031269732020785642

For anyone who has ever filled out a form on a company website, signed up for a newsletter, or downloaded a white paper, the digital infrastructure behind those actions is often a product called Experience Cloud. This week, that ubiquitous platform became the bullseye in a widespread and automated hacking campaign, putting the data submitted through countless corporate sites at potential risk. According to a report from the cybersecurity outlet The Hacker News (@TheHackersNews), threat actors are conducting mass scans of websites built on Salesforce's Experience Cloud, using a custom tool dubbed "AuraInspector" to probe for security weaknesses.

Internal documents from security firms tracking the activity show the scans are not targeted attacks but a broad, opportunistic net being cast across the internet. The AuraInspector tool is designed to automatically identify and test Experience Cloud sites—formerly known as Community Cloud—for misconfigurations and vulnerabilities that could allow unauthorized access. Engineers close to the project say the tool specifically looks for flaws in how these customer and partner portals are set up, which, if left unpatched, could serve as an open door to sensitive backend data. This data often includes personal identifiable information, support tickets, and potentially even integrated corporate data.

The significance here is one of scale and silence. Experience Cloud is a foundational service for thousands of enterprises, from banks to retailers, meaning a single widespread vulnerability could have cascading effects. The attack pattern suggests the actors are in a reconnaissance phase, mapping the landscape of potential targets before likely moving to exploit the weakest links. For the average person, this means the data you submitted through what you believed was a secure corporate portal could be in the process of being indexed by criminals, with no visible sign of a breach on the front-end website you visited.

The rollout of mitigations has been anything but smooth, primarily because the responsibility is fragmented. While Salesforce provides the platform, the security of each individual implementation falls heavily on the company using it. This creates a patchwork response, where security-conscious organizations are urgently auditing their configurations while others remain unaware. What happens next hinges on this awareness gap. Security researchers expect the scanning to intensify, followed by targeted exploitation attempts, likely within weeks. The major uncertainty is how many organizations have the in-house expertise to correctly identify and lock down the specific misconfigurations AuraInspector is seeking. Until that gap closes, a swath of the web's interactive infrastructure remains under a silent, automated siege.

Source: https://x.com/TheHackersNews/status/2031269732020785642