An ongoing data theft campaign uses custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals.

The data-theft campaign, dubbed City-Forum by SaaS security firm Reco, has been traced to a single server that has targeted multiple organizations worldwide. These organizations include telecommunications companies, banks and financial services firms, enterprise software vendors, security and data privacy companies, and public-sector portals.

Reco says the attacks are ongoing, with activity continuing to increase.

The City-Forum data theft attacks

Reco says all of the attacks originate from the IP address 158.220.87.79, hosted by German VPS provider Contabo, and almost always use the default Go-http-client/1.1 user agent when downloading data.

This IP address is associated with the city-forum.com domain, which has resolved to the server since at least March 2025, indicating that the infrastructure has remained in place for more than a year.

The researchers say these combined IOCs have been seen across almost all attacks targeting Salesforce and ServiceNow environments in this campaign.

"The same fingerprint appears against both Salesforce and ServiceNow, across multiple organizations worldwide. It is still running, and the volume is climbing," explains Reco.

"So far, we have only seen guest user activities - never an authenticated user, but we cannot rule it out."

These attacks are not exploiting a vulnerability in Salesforce or ServiceNow.

Instead, they steal data that organizations have mistakenly exposed to unauthenticated guest users through overly permissive sharing rules, permissions, or portal configurations.

Both Salesforce Experience Cloud and ServiceNow use guest accounts to manage unauthenticated visitors. If these accounts are given access to data records, anyone on the Internet can potentially retrieve them through various API endpoints.

On Salesforce, most of the observed activity targets the older Aura framework, where attackers are sending requests to the /aura or /s/sfsites/aura endpoint to determine which objects, such as  Accounts, Contacts, Cases, are publicly accessible.

Reco says the attacker first invokes HostConfigController.getConfigData to enumerate objects available to the guest account and then uses SelectableListDataProviderController.getItems to retrieve records from accessible objects.

Reco says the busiest target recorded more than 560,000 events from the attacker's IP address, with nearly all of them related to guest Aura enumeration.

This type of Salesforce guest-user abuse is not new and has previously been used in ShinyHunters data theft campaigns.

ShinyHunters previously used a modified version of the AuraInspector tool to steal exposed records from misconfigured Experience Cloud portals.

However, the City-Forum attacker is not only targeting these same Aura endpoints, but also Salesforce sites built using the newer Lightning Web Runtime (LWR) framework.

On LWR sites, the attacker uses Salesforce's UI API to steal data exposed to guest accounts through GraphQL requests sent to /webruntime/api/services/data/{version}/graphql.

Reco says it has not seen any public attack tools using this technique, and existing tools such as AuraInspector, S-RET, and CirrusGo do not use the webruntime interface.

The attacker also targets Experience Cloud sites for /SiteRegister and /CommunitiesSelfReg endpoints to determine whether self-registration is enabled, which could allow a guest to create an authenticated external account with broader access.

The same attacker is targeting ServiceNow Service Portals through the native POST /api/now/sp/search?sysparm_cancelable=true endpoint, which Reco says it had not previously seen abused in attacks.

The endpoint, used by ServiceNow's portal search functionality, accepts anonymous requests and can return data when search sources are configured to permit guest access.

Reco says attackers can vary search terms to enumerate exposed information, with one investigated environment seeing requests grow from tens to hundreds per day.

Because ServiceNow transaction logs do not record the POST body, defenders can see that automated searches occurred and how much data was returned, but cannot determine the exact search terms used by the attacker.

While some of this Salesforce activity is similar to previous ShinyHunters attacks, Reco says there is no evidence tying the current campaign to that group.

The researchers also noted that previous campaigns such as ShinyHunters' typically used multiple systems and different IP addresses, while the City-Forum infrastructure has remained on the same IP address since March 2025.

Salesforce administrators are advised to review guest-user sharing rules, object and field permissions, file access, member visibility, and self-registration settings.

For LWR sites, Reco also recommends disabling the Experience Builder option that allows guest users to access public APIs when it is not required. Doing so will block access to various API endpoints used for data enumeration and theft.

ServiceNow administrators should review which search sources are exposed through Service Portals and ensure that sensitive data search sources use strict authentication and access controls.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report