"City-Forum" data-theft attacks target Salesforce, ServiceNow portals
Researchers say a single IP is running an ongoing campaign that steals data exposed to guest users in Salesforce Experience Cloud and ServiceNow portals.
Intelligence analysis by GPT-5.4 Mini
Reco says the campaign uses custom tools, not a Salesforce or ServiceNow flaw, to harvest data exposed by permissive guest settings. The same infrastructure has been active since at least March 2025 and is still expanding.
It is like leaving office filing cabinets unlocked in the lobby and then being surprised when someone walks in and reads the papers. The attackers are not breaking the lock on the building; they are using doors that were left open for visitors.
Analysis
158.220.87.79
Reco’s most important clue is the apparent consistency of the infrastructure. The campaign is tied to a single IP address, 158.220.87.79, and the researchers say it has been in place since at least March 2025. That kind of persistence makes the operation feel less like opportunistic probing and more like a standing collection pipeline.
The operational style also matters. Reco says the traffic almost always uses the default Go-http-client/1.1 user agent, which suggests an automated workflow rather than a noisy human operator. If the same host is hitting many organizations across sectors, defenders should assume the attacker is optimizing for repeatability and scale, not stealth in the traditional malware sense.
The fact that the activity is still increasing is the bigger warning. Persistent infrastructure lets attackers test exposure, return later, and adapt to whatever defenders have fixed since the previous visit. In other words, a one-time review is not enough when the source of abuse remains live.
Aura
On Salesforce, the campaign appears to rely on the platform’s own guest-access plumbing. Reco says the attacker is using the older Aura framework to enumerate objects available to anonymous users and then pull records from whatever is exposed. That shifts the problem away from a software vulnerability and squarely onto portal design and permission hygiene.
This is a familiar but still dangerous pattern. If guest accounts can see records, then the internet can often see them too, just through an API instead of a browser. The article’s point is not that Salesforce is broken, but that misconfigured sharing rules and object permissions can turn a public portal into a data faucet.
The newer Lightning Web Runtime behavior is even more interesting because it widens the set of exposed paths attackers can try. Reco says the campaign is using GraphQL requests against the UI API on LWR sites, and it has not seen common public tools doing that. That means defenders cannot rely on old playbooks alone; they need to understand which public interfaces their own configuration opens.
Blue Report 2026
The ServiceNow side reinforces the same lesson from a different angle. Reco says the attacker is abusing a native portal search endpoint that can return data when search sources allow guest access, and that the body of those POST requests is not recorded in transaction logs. That makes detection harder, because defenders can see that something happened without easily seeing exactly what was searched.
The article closes with a broader warning from the Blue Report 2026: once attackers have valid credentials, only 37% of their actions are blocked. That is a useful reminder that perimeter controls and prevention scores can look healthier than the real world once an intruder has crossed the first gate.
The upside is that this campaign is still highly addressable. Salesforce administrators can tighten guest-user permissions, review self-registration, and disable public API access where it is unnecessary, while ServiceNow teams can restrict exposed search sources. If those controls are enforced consistently, the attacker’s main advantage disappears: quiet access to data that should never have been public in the first place.
Key points
- Reco says a single IP address is behind an ongoing campaign against Salesforce Experience Cloud and ServiceNow portals.
- The activity targets data exposed to anonymous guest users, not a flaw in Salesforce or ServiceNow themselves.
- Salesforce abuse centers on Aura and LWR endpoints that can enumerate and retrieve publicly accessible records.
- ServiceNow abuse uses a native portal search endpoint that can return data when guest search sources are allowed.
- The researchers say the campaign is still active and increasing in volume.
Administrators can still shut this down by tightening guest permissions, reviewing self-registration, and limiting public API access. If ServiceNow search sources and Salesforce portal settings are locked down, the attacker’s main path to exposed data gets much harder to use.
If organizations leave guest access too broad, the campaign can keep quietly collecting records from multiple portals. The article also suggests that logs may not capture enough detail in some ServiceNow cases, which makes it harder to spot what was taken before the damage is done.
