Emerging ThreatsData Breaches

City-Forum Attacks Exploit Salesforce, ServiceNow Portals for Data Theft

Analyst 207||Source: BleepingComputer
Public sector office interior with subtle digital infrastructure and blurred people in the background.

"All of the attacks originate from the IP address 158.220.87.79," Reco said — a precise, persistent fingerprint that has been targeting corporate and public portals for more than a year and shows no sign of stopping.

Reco links activity to 158.220.87.79 and the city-forum.com host

SaaS security firm Reco traced an ongoing data-theft campaign to a single server hosted by German VPS provider Contabo. The IP address 158.220.87.79 is associated with the domain city-forum.com and has resolved to that server since at least March 2025. Reco reports the infrastructure has been used against multiple organizations worldwide, including telecommunications companies, banks and financial services firms, enterprise software vendors, security and data privacy companies, and public-sector portals.

The campaign’s network fingerprint is consistent: downloads almost always use the default Go-http-client/1.1 user agent. Reco says the same combination of indicators of compromise has been seen across nearly all the campaign’s attacks targeting Salesforce and ServiceNow.

How the campaign extracts data from Salesforce Experience Cloud (Aura and LWR)

Reco says the attacker is not exploiting a software vulnerability in Salesforce; instead the campaign abuses guest or anonymous access that organizations have mistakenly allowed. Both Salesforce Experience Cloud and ServiceNow use guest accounts to manage unauthenticated visitors, and when those accounts are granted access to records or search sources the data becomes retrievable over public API endpoints.

Against Salesforce sites built on the older Aura framework, Reco observed requests to /aura and /s/sfsites/aura endpoints that enumerate accessible objects — Accounts, Contacts, Cases, and others. The attacker first invokes HostConfigController.getConfigData to discover which objects a guest account can see, and then uses SelectableListDataProviderController.getItems to retrieve the exposed records. Reco recorded one target receiving more than 560,000 events from the attacker’s IP, nearly all related to guest Aura enumeration.

The City-Forum actor also targets sites built on the newer Lightning Web Runtime (LWR). On LWR sites the attacker conducts GraphQL requests against Salesforce’s UI API at /webruntime/api/services/data/{{version}}/graphql to harvest data available to guest users. Reco notes this technique is not present in publicly known tools: existing utilities such as AuraInspector, S-RET, and CirrusGo do not use the webruntime interface.

Additionally, the attacker probes Experience Cloud endpoints like /SiteRegister and /CommunitiesSelfReg to determine whether self-registration is enabled — a setting that could allow creation of an authenticated external account with broader access if misconfigured.

ServiceNow Service Portal searches abused via POST /api/now/sp/search

The same actor also targets ServiceNow service portals by abusing the native POST /api/now/sp/search?sysparm_cancelable=true endpoint. Reco says the endpoint is used by ServiceNow’s portal search functionality, accepts anonymous requests, and can return data when search sources are configured to permit guest access.

Attackers can vary search terms to enumerate exposed information; Reco observed automated requests grow from tens to hundreds per day in at least one environment. A defensive blind spot: ServiceNow transaction logs do not record the POST body, so while administrators can see that automated searches occurred and how much data returned, they cannot determine the exact search terms used by the attacker.

Similarities to prior campaigns, and what the operational profile reveals

Some aspects of the Salesforce activity resemble previous ShinyHunters campaigns that abused guest-user access and modified AuraInspector tooling to exfiltrate misconfigured Experience Cloud records. Reco, however, found no evidence tying City-Forum to ShinyHunters and highlighted operational differences: earlier campaigns typically used multiple systems and IP addresses, whereas the City-Forum infrastructure has remained on the same IP address since March 2025.

Reco emphasized the campaign’s persistence and growth: "The same fingerprint appears against both Salesforce and ServiceNow, across multiple organizations worldwide. It is still running, and the volume is climbing," the firm said. "So far, we have only seen guest user activities - never an authenticated user, but we cannot rule it out."

What this means for Salesforce administrators, ServiceNow administrators, and enterprise security teams

  • Salesforce administrators: Reco advises reviewing guest-user sharing rules, object and field permissions, file access, member visibility, and self-registration settings. For LWR sites, Reco recommends disabling the Experience Builder option that allows guest users to access public APIs when it is not required, which blocks many of the GraphQL endpoints used for enumeration.
  • ServiceNow administrators: Review which search sources are exposed through Service Portals and ensure sensitive data search sources require strict authentication and access controls. Be aware that logs will show request volume and returned data but not the POST body, complicating forensic reconstruction of what was queried.
  • Enterprise security teams: The campaign underlines how "prevention" metrics can mask post-access risks; Reco points to the Blue Report 2026, which measures defenses technique by technique across 338 million simulations and notes prevention falls sharply once attackers leverage valid credentials or otherwise bypass initial controls.

The City-Forum campaign is a reminder that misconfiguration can be as consequential as a software flaw: public APIs and guest accounts intended for usability can become data pipes if permissions are too permissive. Defenders can still act on concrete, configuration-level fixes — but the attacker’s single-server persistence and rising volume make speed and thoroughness essential.

Source: BleepingComputer — City-Forum data-theft attacks target Salesforce, ServiceNow portals

Cloud SecurityData TheftEmerging ThreatsNation-StateSalesforceSupply ChainThreat IntelligenceSaas SecurityServicenowIP Abuse
Related Intelligence

Continue Reading

Person sits in dimly lit living room, staring at blank smartphone screen with a somber expression.

Malware Combo Targets Android Users With Loans, Credit Card Theft

In just 13 minutes, a sophisticated scam combining malware and social engineering tricked Android users into handing over their accounts and credit card info, with the thieves monetizing stolen cards in real time. The attack started with a convincing phone call from someone posing as a bank employee, leading victims to unwittingly download a remote administration tool masquerading as a legitimate app.

Analyst 207
Server room with rows of computer equipment and a lone workstation in the foreground.

AI Agents Compromise Taiwan's Nuclear Safety Agency in Near-Autonomous Attack

In a chilling near-autonomous attack, AI agents breached Taiwan's Nuclear Safety Agency, compromising 85 government accounts and extracting over 2,500 sensitive personnel records in just four days. The sophisticated operation was uncovered by Israeli cybersecurity firm Dream, which revealed a treasure trove of stolen data, including user credentials and internal network information.

Analyst 207
A retail checkout area with a laptop and POS terminal on a mid-tone background.

Hackers Exploit Adobe Commerce Flaw to Hijack Customer Accounts

Hackers can hijack your customer accounts with just a few clicks, thanks to a critical flaw in Adobe Commerce that lets attackers switch to another customer's session, gaining access to sensitive data. This vulnerability, tracked as CVE-2026-71362, is a wake-up call for businesses to take immediate action and protect their customers' private info.

Analyst 207
Government office interior with computer workstations, personnel, and network equipment near a large window.

Hackers Deploy AI for Near-Autonomous Attack on Taiwan Government

In a chilling first, hackers unleashed a near-autonomous AI-driven cyber attack on the Taiwanese government, extracting over 2,500 personnel records with alarming ease. This groundbreaking attack was able to adapt and evolve mid-operation, all without human intervention.

Analyst 207