One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

Summary

A persistent threat actor, dubbed the City Forum campaign, has been scraping data from Salesforce and ServiceNow customer portals since at least March 2025. The attacker uses a single server and a custom Go-based tool to exploit guest identity misconfigurations, accessing both older Aura framework and newer UI-API surfaces on Salesforce, as well as ServiceNow's Service Portal search endpoint. The campaign targets multiple industries, including finance, telecoms, and public sector organizations, with the volume of activity reportedly increasing.

Full text

One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025 The Hacker NewsAug 18, 2026SaaS Security / Cloud Security A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a commodity VPS through the German provider Contabo. Every request from that server carries the same fingerprint, the default user agent of Go's net/http library, which tells researchers the tool behind it is a compiled, purpose built program rather than anything run from a browser. Passive DNS shows the same domain pointed at that IP as far back as March 2025, and the server has not moved since. Targets identified so far span telecoms, banks and other financial services firms, enterprise software vendors including security and data privacy companies, and public sector portals, though Reco has not named individual organizations. What sets this campaign apart from prior Salesforce guest access abuse, including the widely reported activity attributed to ShinyHunters, is the range of surfaces it touches. Most known attackers in this space lean on Salesforce's older Aura framework, sending high volumes of guest requests to enumerate objects and page through records. This actor does that too, and Aura still accounts for the bulk of the traffic Reco observed, with one target logging over 560,000 events from the same IP. But the tool also reaches Salesforce's newer Lightning Web Runtime sites through the UI-API, a data layer that has no public write ups or known scanning tools associated with it, walking through API versions v56.0 through v66.0 in sequence. On top of that, the same server hammers a native ServiceNow Service Portal search endpoint, POST /api/now/sp/search, that carries almost no public documentation of its own. According to Reco's writeup, the common thread across every technique is the same underlying issue: a guest identity that was granted more access than the site actually needed to serve the public. Salesforce Experience Cloud sites and ServiceNow portals both maintain a persistent guest user that unauthenticated visitors execute as, and that user cannot be deleted, only restricted. If the guest profile can read a record, the record is effectively public, whether or not the site requires login to view it in a browser. The research lays out concrete detection steps for security and IT teams on both platforms. On Salesforce, defenders with Event Monitoring or Shield can pull AuraRequest and Sites log events and look for the Go-http-client user agent, the specific IP, and request paths containing /webruntime/api/services/data, alongside spikes in self registration attempts at /SiteRegister and /CommunitiesSelfReg. On ServiceNow, the transaction log table syslog_transaction can be filtered by source IP and by URLs starting with /api/now/sp/search, with guest created rows and unusual output length flagged as the clearest signal of a live sweep. Remediation, per the research, centers on tightening the guest profile rather than the endpoints themselves, since both the UI-API and the ServiceNow search endpoint are working as designed. On Salesforce, that means reviewing guest sharing rules, stripping unnecessary object and field level access from the guest profile, disabling self registration where it is not required, and turning off the Experience Builder setting that allows guest users to reach public APIs. On ServiceNow, the fix is mapping which search sources are exposed to public facing portals and auditing the Knowledge Base read criteria that decide what an anonymous search actually returns. Reco says the infrastructure behind the campaign is still active and the volume is climbing, and the firm has not attributed the activity to a specific named group. The full technical breakdown, including request signatures, sample queries, and a closer look at how the Service Portal search endpoint decides what to hand back to an anonymous caller, is available in Reco's writeup of the City Forum campaign. Security leaders weighing how much of their budget to put toward this kind of app exposure, versus other priorities competing for the same dollars, can find a planning framework in Reco's guide to AI security investment, which covers how to size budget, evaluate vendors, and build a business case for the board. <img alt="" height="1" src="https://px.ads.linkedin.com/collect/?pid=4587841&amp;fmt=gif" style="display:none;" width="1" /> Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  API Security, Cloud security, Data Exposure, enterprise security, Identity Security, SaaS Security, Threat Intelligence, Web Security ⚡ Top Stories This Week Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables 18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers ⭐ Featured Resources See How to Stop the Browser-Based Attacks Your Existing Stack Misses [Book a Live Demo] [Webinar] See Where Claude Fits in the SOC and Where It Falls Short at Scale Defend Against One-Click AI Memory Poisoning — Download the Cheat Sheet Benchmark Your Defenses Against 338M+ Attack Simulations — Download the Blue Report 2026

Indicators of Compromise

• ip — 158.220.87.79
• domain — cityforum.com
• mitre_attack — T1078.004
• mitre_attack — T1595.002

Entities