City-Forum Data Theft Campaign Targets Salesforce and ServiceNow Portals

A new data theft campaign is using custom tools to steal information exposed to unauthenticated users through Salesforce Experience Cloud and ServiceNow customer portals.

Cybersecurity company Reco has dubbed the campaign City-Forum and traced the activity to a single server targeting organizations around the world. Victims include telecommunications companies, banks and financial services providers, enterprise software vendors, cybersecurity and data privacy companies, and public-sector portals.

Reco researchers say the campaign is ongoing, with attack volumes continuing to increase.

City-Forum data theft attacks

According to Reco, the attacks originate from the IP address 158.220.87.79, which is hosted by German VPS provider Contabo. In most cases, the attackers use the default Go-http-client/1.1 user agent when downloading data.

The IP address is associated with city-forum.com, a domain that has resolved to servers since at least March 2025. This suggests that the campaign’s infrastructure has been maintained for more than a year.

Researchers observed the same indicators of compromise in nearly all attacks targeting Salesforce and ServiceNow environments as part of the campaign.

“We’re seeing the same fingerprint for both Salesforce and ServiceNow across multiple organizations around the world. It’s still running, and the volumes are increasing,” Reco explained in a report on the City-Forum campaign.

“So far, we have only seen activity by guest users and not by authenticated users, but we cannot rule it out.”

The attacks do not exploit software vulnerabilities in Salesforce or ServiceNow. Instead, they abuse data that organizations have unintentionally exposed to unauthenticated guest users through overly permissive sharing rules, access permissions, or portal configurations.

Salesforce Experience Cloud and ServiceNow use guest accounts to manage unauthenticated visitors. If those accounts can access business records, anyone on the internet may be able to retrieve the exposed information through publicly accessible API endpoints.

Salesforce guest user access abused to enumerate data

In Salesforce, much of the observed activity targets the older Aura framework. Attackers send requests to /aura and /s/sfsites/aura endpoints to identify publicly accessible objects, including accounts, contacts, and cases.

Reco said the attackers first call HostConfigController.getConfigData to enumerate objects available to the guest account. They then use SelectableListDataProviderController.getItems to retrieve records from accessible objects.

One of the busiest targets recorded approximately 560,000 events from the attacker’s IP address, most of which involved guest-user Aura enumeration.

Abusing Salesforce guest-user access is not a new technique. The ShinyHunters data theft campaign previously used a modified version of the AuraInspector tool to steal records exposed through misconfigured Experience Cloud portals.

However, the City-Forum operators are targeting both older Aura endpoints and Salesforce sites built with the newer Lightning Web Runtime (LWR) framework.

On LWR sites, the attackers use Salesforce’s UI API to access data exposed to guest accounts through GraphQL requests sent to /webruntime/api/services/data/{version}/graphql.

Reco said it has not identified any publicly available attack tools that use this technique. The researchers also found no evidence that the attackers used tools such as AuraInspector, S-RET, or CirrusGo against the webruntime interface.

Self-registration and ServiceNow search endpoints targeted

The attackers also target Salesforce Experience Cloud sites through the /SiteRegister and /CommunitiesSelfReg endpoints. These requests help determine whether self-registration is enabled, potentially allowing attackers to create authenticated external accounts with broader access.

The same threat actor is targeting ServiceNow service portals through the native POST /api/now/sp/search?sysparm_cancelable=true endpoint. Reco said it had not previously seen this endpoint used in a data theft campaign.

The ServiceNow portal search endpoint can accept anonymous requests and return information when a search source is configured to permit guest access.

Attackers can modify search terms to identify and extract exposed information. In one environment analyzed by Reco, the number of requests increased from dozens to hundreds per day.

ServiceNow transaction logs do not record the POST request body. As a result, defenders can determine that an automated search occurred and see how much data was returned, but they may not be able to identify the exact search terms used by the attacker.

Although some of the Salesforce activity resembles earlier ShinyHunters attacks, Reco said there is currently no evidence linking the City-Forum campaign to that group.

Researchers also noted that previous campaigns, including ShinyHunters operations, typically used multiple systems and IP addresses. In contrast, the City-Forum infrastructure has continued using the same IP address since March 2025.

How to protect Salesforce and ServiceNow environments

Salesforce administrators should review guest-user and sharing rules, object- and field-level permissions, file access controls, member visibility settings, and self-registration configurations.

For LWR sites, Reco recommends disabling the Experience Builder setting that allows guest users to access public APIs when the feature is not required. Disabling the setting can block access to API endpoints used to enumerate and steal exposed data.

ServiceNow administrators should review which search sources are available through the service portal. Search sources containing sensitive information should require authentication and enforce strict access controls.

The overall prevention score can hide what happens after initial access. If an attacker uses valid credentials, your defenses can drop sharply.

Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report