Mystery attacker spent a year raiding Salesforce and ServiceNow portals

Custom tools harvested whatever over-permissioned guest accounts would surrender