Ethical Hacking News
A sophisticated attack on Salesforce and ServiceNow customer portals has been uncovered by the agent security platform Reco, revealing the vulnerabilities of SaaS security and the importance of robust threat intelligence. The City Forum campaign, launched since March 2025, has been scraping records from both platforms across multiple industries, targeting telecoms, banks, and other financial services firms, enterprise software vendors, and public sector portals. The attack highlights the need for continuous monitoring, robust security measures, and the importance of addressing the evolving threat landscape.
Reco's agent security platform has discovered a sophisticated attack on Salesforce and ServiceNow customer portals, highlighting vulnerabilities in SaaS security. The attack, dubbed "City Forum," has been ongoing since March 2025 and targets multiple industries, including telecoms, banks, and enterprise software vendors. The attack uses a compiled program to scrape records from both Salesforce and ServiceNow customer portals, exploiting a guest identity granted more access than needed. The attack reaches Salesforce's newer Lightning Web Runtime sites through the UI-API, a data layer with limited documentation. Remediation centers on tightening guest profiles rather than endpoint security, with specific steps outlined by Reco's research. The research highlights the importance of continuous monitoring, robust threat intelligence, and robust security measures to prevent such attacks.
A recent revelation by the agent security platform Reco has shed light on a sophisticated attack on Salesforce and ServiceNow customer portals, highlighting the vulnerabilities of SaaS security and the importance of robust threat intelligence. The City Forum campaign, as Reco has dubbed it, has been unfolding since March 2025, with a single piece of infrastructure at the helm: a server hosted on a commodity VPS through the German provider Contabo.
This server, identified as 158.220.87.79, has been the focal point of the campaign, with every request carrying the same fingerprint - the default user agent of Go's net/http library. This tells researchers that the tool behind it is a compiled, purpose-built program rather than anything run from a browser. The passive DNS data reveals that the same domain has been pointed at this IP address since March 2025, and the server has not moved since, indicating a level of persistence and sophistication in the attack.
The City Forum campaign has managed to scrape records out of both Salesforce and ServiceNow customer portals across multiple industries, targeting telecoms, banks, and other financial services firms, enterprise software vendors, and public sector portals. What sets this campaign apart from prior Salesforce guest access abuse, including the widely reported activity attributed to ShinyHunters, is the range of surfaces it touches. Most known attackers in this space lean on Salesforce's older Aura framework, sending high volumes of guest requests to enumerate objects and page through records.
However, the tool behind the City Forum campaign also reaches Salesforce's newer Lightning Web Runtime sites through the UI-API, a data layer that has no public write-ups or known scanning tools associated with it, walking through API versions v56.0 through v66.0 in sequence. On top of that, the same server hammers a native ServiceNow Service Portal search endpoint, POST /api/now/sp/search, that carries almost no public documentation of its own.
The common thread across every technique is the same underlying issue: a guest identity that was granted more access than the site actually needed to serve the public. Salesforce Experience Cloud sites and ServiceNow portals both maintain a persistent guest user that unauthenticated visitors execute as, and that user cannot be deleted, only restricted. If the guest profile can read a record, the record is effectively public, whether or not the site requires login to view it in a browser.
Reco's research lays out concrete detection steps for security and IT teams on both platforms. On Salesforce, defenders with Event Monitoring or Shield can pull AuraRequest and Sites log events and look for the Go-http-client user agent, the specific IP, and request paths containing /webruntime/api/services/data, alongside spikes in self-registration attempts at /SiteRegister and /CommunitiesSelfReg. On ServiceNow, the transaction log table syslog_transaction can be filtered by source IP and by URLs starting with /api/now/sp/search, with guest-created rows and unusual output length flagged as the clearest signal of a live sweep.
Remediation, per the research, centers on tightening the guest profile rather than the endpoints themselves, since both the UI-API and the ServiceNow search endpoint are working as designed. On Salesforce, that means reviewing guest sharing rules, stripping unnecessary object and field-level access from the guest profile, disabling self-registration where it is not required, and turning off the Experience Builder setting that allows guest users to reach public APIs. On ServiceNow, the fix is mapping which search sources are exposed to public-facing portals and auditing the Knowledge Base read criteria that decide what an anonymous search actually returns.
The infrastructure behind the City Forum campaign is still active, with the volume climbing, and Reco has not attributed the activity to a specific named group. The research highlights the importance of continuous monitoring, robust threat intelligence, and robust security measures to prevent such attacks.
In conclusion, the City Forum campaign is a stark reminder of the evolving threat landscape and the need for robust security measures to protect SaaS applications from sophisticated attacks. As security leaders weigh how much of their budget to put toward this kind of app exposure, versus other priorities competing for the same dollars, Reco's research provides a valuable planning framework, including a guide to AI security investment, which covers how to size budget, evaluate vendors, and build a business case for the board.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-City-Forum-Campaign-A-Sophisticated-Attack-on-Salesforce-and-ServiceNow-Portals-ehn.shtml
https://thehackernews.com/2026/08/one-attacker-has-scraped-both.html
https://cybersecuritynews.com/salesforce-and-servicenow-targeted-in-attacks/
Published: Tue Aug 18 07:27:58 2026 by llama3.2 3B Q4_K_M
