Salesforce and ServiceNow Face Global Attack Campaign Targeting Exposed Customer Data

An advanced threat actor is targeting Salesforce and ServiceNow instances worldwide in an ongoing campaign that has been harvesting data from publicly accessible portals, according to security researchers at Reco.

The campaign, dubbed “City-Forum,” has been active from infrastructure that dates back to at least March 2025. Researchers say a single server has been observed pulling records from Salesforce Experience Cloud sites and ServiceNow Service Portals across organisations in multiple industries, including telecom, banking, financial services, enterprise software and the public sector.

What makes the campaign particularly concerning is the attacker’s tooling. Rather than relying entirely on well-known open-source scanners, the threat actor appears to have developed a custom toolset capable of probing less-documented interfaces on both platforms.

"The attacker reaches Salesforce Lightning Web Runtime (LWR) sites through the UI-API, a data layer we have not seen any public tool or write-up about, and it hammers a native ServiceNow Service Portal search endpoint that has almost no online documentation or well-known open-source tools," Nitay Bachrach, Reco Senior Security Officer, wrote in the blog post.

Researchers traced the activity to the IP address 158.220.87.79, hosted on infrastructure operated by German provider Contabo. The same IP resolves to the domain city-forum.com, which has pointed to the server since at least March 2025. The attacker has consistently used the Go-http-client/1.1 user agent, suggesting an automated tool rather than normal browser activity.

Attackers Expand Beyond Traditional Salesforce Targets

On Salesforce, the campaign goes beyond the better-known Aura attack surface. Researchers identified activity against Salesforce's newer Lightning Web Runtime (LWR) sites, using UI-API and GraphQL endpoints to enumerate and retrieve information accessible to guest users.

The attacker also repeatedly tested Salesforce self-registration endpoints, including /SiteRegister and /CommunitiesSelfReg, apparently looking for sites where an anonymous visitor could create an authenticated external account with greater access.

The scale of some of the activity is significant. Reco says the busiest Salesforce target recorded more than 560,000 events from the attacker’s IP, largely involving guest-user enumeration through Aura.

On ServiceNow, meanwhile, the attacker focused on the native Service Portal search endpoint /api/now/sp/search. Researchers say the endpoint has little public documentation and is not widely covered by existing security tools, making its use another indication that the attacker has conducted its own research into the platforms.

The campaign does not necessarily indicate a vulnerability in either Salesforce or ServiceNow. Reco says the data accessed by the attacker was exposed because organisations had configured guest users with permissions that allowed anonymous access.

“Every byte the attacker retrieved was something a site owner had exposed to anonymous users,” Bachrach wrote in the report.

Misconfigured Guest Access Emerges as the Weak Link

Reco has not attributed the campaign to a specific threat group. While some activity resembles previous Salesforce campaigns associated with ShinyHunters, Reco cautioned that similarities in attack techniques are insufficient for attribution.

Instead, the investigation points to a familiar enterprise security problem– over-permissioned anonymous access. On Salesforce, researchers recommend reviewing guest-user sharing rules, removing unnecessary object and field permissions, disabling self-registration where it is not required and restricting guest access to files and member information. For LWR sites, they specifically recommend disabling the setting that allows guest users to access public APIs.

For ServiceNow, organisations should review which search sources are exposed through public portals and ensure that knowledge bases and other data sources enforce appropriate access controls.