An ongoing data theft campaign is using custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals.
The data theft campaign, dubbed “City-Forum” by SaaS security firm Reco, was traced to a single server that targeted multiple organizations worldwide. These organizations include telecommunications companies, banks and financial services providers, enterprise software providers, security and data protection companies, and public sector portals.
According to Reco, the attacks are ongoing and activity continues to increase.
The City Forum data theft attacks
According to Reco, all attacks originate from the IP address 158.220.87.79hosted by German VPS provider Contabo, and almost always use the default setting Go-http-client/1.1 User agent downloading data.
This IP address is linked to the city-forum.com Domain resolved on the server since at least March 2025, indicating that the infrastructure has remained in place for more than a year.
The researchers say these combined IOCs were observed in almost all attacks targeting Salesforce and ServiceNow environments in this campaign.
“The same fingerprint appears on both Salesforce and ServiceNow in multiple organizations worldwide. It’s still running and volume is increasing.” explains Reco.
“So far we’ve only seen guest user activity – never an authenticated user, but we can’t rule it out.”
These attacks do not exploit a vulnerability in Salesforce or ServiceNow.
Instead, they steal data that companies have mistakenly made available to unauthenticated guest users through overly permissive sharing rules, permissions, or portal configurations.
Both Salesforce Experience Cloud and ServiceNow use guest accounts to manage unauthenticated visitors. If these accounts are granted access to records, anyone on the Internet can potentially retrieve them through various API endpoints.
At Salesforce, most of the activity observed targets the older Aura framework, to which attackers send requests /aura or /s/sfsites/aura Endpoint to determine which objects, such as B. accounts, contacts, cases, are publicly accessible.
Reco says the attacker calls first HostConfigController.getConfigData to enumerate objects available to the guest account and then use them SelectableListDataProviderController.getItems to retrieve records from accessible objects.
Reco says the busiest destination has more than recorded 560,000 events from the attacker’s IP address, almost all of which are related to the guest aura enumeration.
This type of abuse of Salesforce guest users is not new and has been used in data theft campaigns by ShinyHunters.
ShinyHunters previously used a modified version of the AuraInspector tool to steal exposed records from misconfigured Experience Cloud portals.
However, the City Forum attacker not only targets the same Aura endpoints, but also Salesforce sites built with the newer ones Lightning Web Runtime (LWR) Frame.
On LWR sites, the attacker leverages Salesforce’s UI API to steal data exposed to guest accounts via GraphQL requests sent to /webruntime/api/services/data/{version}/graphql.
Reco says it has not seen any public attack tools using the technique, and existing tools such as AuraInspector, S-RET and CirrusGo do not use it webruntime Interface.
Source: Reco
The attacker also targets Experience Cloud sites /SiteRegister And /CommunitiesSelfReg Endpoints to determine whether self-registration is enabled, which could allow a guest to create an authenticated external account with broader access.
The same attacker targets ServiceNow service portals via Native POST /api/now/sp/search?sysparm_cancelable=true Endpoint that, according to Reco, has not yet been abused in attacks.
The endpoint used by ServiceNow’s portal search functionality accepts anonymous requests and can return data when search sources are configured to allow guest access.
According to Reco, attackers can vary search terms to list exposed information. In one environment studied, requests increased from dozens to hundreds per day.
Because ServiceNow transaction logs do not record the POST text, defenders can see that automated searches were performed and how much data was returned, but they cannot determine the exact search terms the attacker used.
While some of this Salesforce activity is similar to previous ShinyHunters attacks, Reco says there is no evidence linking the current campaign to this group.
The researchers also noted that previous campaigns like ShinyHunters’s typically used multiple systems and different IP addresses, while the City Forum infrastructure has remained on the same IP address since March 2025.
Salesforce administrators are recommended to review guest user sharing rules, object and field permissions, file access, member visibility, and self-registration settings.
For LWR sites, Reco also recommends disabling the Experience Builder option, which allows guest users to access public APIs when not required. This blocks access to various API endpoints used for data enumeration and data theft.
ServiceNow administrators should review which search sources are exposed through service portals and ensure that search sources use strong authentication and access controls for sensitive data.
Overall prevention scores can hide what happens after the first access. Once attackers use valid credentials, prevention drops sharply.
The 2026 Blue Report measures defense technology for technology in 338 million simulations conducted in customer production environments.
