Mystery attacker spent a year raiding Salesforce and ServiceNow portals
Custom tools harvested whatever over-permissioned guest accounts would surrender
We haven't written up this one. The Register Science has the full story — the link below goes straight to it.