An ongoing data theft campaign dubbed “City-Forum” is targeting information exposed to unauthenticated users through Salesforce Experience Cloud and ServiceNow customer portals, affecting organisations across sectors including telecommunications, banking, financial services, enterprise software, security, data privacy and the public sector.
SaaS security firm Reco said the activity has been traced to a single server and continues to increase. The attacks do not exploit a vulnerability in Salesforce or ServiceNow. Instead, they target information that organisations have unintentionally made accessible to guest users through permissive sharing rules, permissions or portal configurations.
Campaign Traced to Single Server Infrastructure
The activity has been linked to IP address 158.220.87.79, hosted by German VPS provider Contabo. The same infrastructure is associated with the city-forum.com domain, which has resolved to the server since at least March 2025.
Reco said similar technical fingerprints have appeared in attacks against both Salesforce and ServiceNow environments across multiple organisations worldwide. So far, the observed activity has involved guest users rather than authenticated accounts. Guest accounts are used by both platforms to provide access to unauthenticated visitors. If permissions expose internal records to those accounts, information can potentially be retrieved through publicly reachable API interfaces.
Salesforce Guest Access Targeted at Scale
Much of the Salesforce activity has focused on the older Aura framework, where attackers probe publicly accessible objects such as Accounts, Contacts and Cases before attempting to retrieve exposed records. One heavily targeted environment recorded more than 560,000 events from the attacker’s IP address, with most linked to guest Aura enumeration.
The campaign has also targeted Salesforce sites using the newer Lightning Web Runtime framework. In those environments, the attacker uses Salesforce’s UI API and GraphQL requests to retrieve information exposed to guest accounts. The attacker has additionally checked Experience Cloud self-registration functions, potentially identifying whether a guest user could create an authenticated external account with broader access.
Similar Salesforce guest-user abuse has previously appeared in ShinyHunters data theft campaigns, but Reco said there is no evidence connecting City-Forum to that group.
ServiceNow Portals Also Face Automated Probing
ServiceNow Service Portals are being targeted through their native search functionality, which can accept anonymous requests and return information when search configurations permit guest access.
Attackers can vary search terms to enumerate exposed data, with one examined environment seeing request volumes rise from dozens to hundreds per day. Reco said defenders may be able to see automated searches and the volume of information returned, although ServiceNow transaction logs do not record the POST body, making it difficult to determine the precise search terms used.
Administrators have been advised to review guest-user sharing rules, object and field permissions, file access, member visibility and self-registration settings. For Lightning Web Runtime sites, disabling unnecessary guest access to public APIs can also restrict endpoints being used for data enumeration and theft.
