InfoSecBulletin Cybersecurity for mankind
A data theft plan is stealing information from anonymous users on Salesforce Experience Cloud and ServiceNow customer portals using special tools. The data theft campaign, called City-Forum by the software security company Reco, comes from one server that has attacked many groups around the world. These groups include phone companies, banks, software companies, security and privacy firms, and government websites. Reco says the attacks are ongoing, with activity continuing to increase.
The City-Forum data theft attacks
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
Palo Alto Patches 11 New flaws Across PAN-OS, GlobalProtect, and Prisma Access
CVE-2026-20349, CVE-2026-68820
Cisco and Windows patched zero days exploited in attack
Microsoft Patch 394 Flaws, Including 3 Zero-Days
AI Finds Nation-State-Level Zoom Flaw in Under 24 Hours, Zero-Click Attack Exposed
Hacker Actively Exploit SonicWall and SharePoint Flaws
Gunra Ransomware Leverage Fortinet VPN Flaws to Evade MFA Obtaining Enterprise Data
Hackers accessed a US defense manufacturer’s Microsoft 365 account via phishing.
Google Play Apps Utilize Stealth Loaders to Spread Anatsa Banking Malware
Bangladeshi org listed “the Gentlemen’ ransomware victim list: CIRT warns
Reco says that all the attacks come from the IP address 158.220.87.79, which is owned by the German VPS provider Contabo. They mostly use the default Go-http-client/1.1 user agent when stealing data.
This IP address is linked to the city-forum.com website. It has been connected to the server since at least March 2025, meaning the setup has stayed the same for over a year. The researchers found these IOCs in nearly all attacks on Salesforce and ServiceNow during this campaign.
“The same fingerprint appears against both Salesforce and ServiceNow, across multiple organizations worldwide. It is still running, and the volume is climbing,” explains Reco. “So far, we have only seen guest user activities – never an authenticated user, but we cannot rule it out.”
These attacks don’t take advantage of any weakness in Salesforce or ServiceNow. They take data that companies have carelessly made available to unauthorized guest users due to loose sharing rules, permissions, or portal settings.
Salesforce Experience Cloud and ServiceNow both use guest accounts for managing visitors who are not logged in. If these accounts can access data records, anyone online might be able to get them through different API endpoints.
Most activity on Salesforce focuses on the old Aura framework. Attackers are sending requests to the /aura or /s/sfsites/aura endpoint to find out which objects like Accounts, Contacts, and Cases can be accessed publicly.
Reco says the attacker first invokes HostConfigController.getConfigData to enumerate objects available to the guest account and then uses SelectableListDataProviderController.getItems to retrieve records from accessible objects.
Reco reports that the busiest target had over 560,000 events from the attacker’s IP address. Most of these were linked to guest Aura enumeration. This kind of abuse of Salesforce guest users is not new. It has been used before in ShinyHunters data theft attacks.
ShinyHunters once used a changed version of the AuraInspector tool to take records from poorly set up Experience Cloud portals. Now, the City-Forum attacker is not just hitting these Aura endpoints but also Salesforce sites made with the newer Lightning Web Runtime (LWR) framework.
On LWR sites, the attacker uses Salesforce’s UI API to steal data exposed to guest accounts through GraphQL requests sent to /webruntime/api/services/data/{version}/graphql.
Reco says it hasn’t found any public tools using this method. Tools like AuraInspector, S-RET, and CirrusGo do not use the webruntime interface.
Source: Reco
The attacker also checks Experience Cloud sites at /SiteRegister and /CommunitiesSelfReg to see if self-registration is on. This could let a guest create an account with more access.
The same attacker is hitting ServiceNow Service Portals using the POST /api/now/sp/search?sysparm_cancelable=true endpoint. Reco says it has not seen this being misused in attacks before.
The endpoint for ServiceNow’s search can take unknown users’ requests and can give back data if the search sources allow guest access.
Reco says attackers can change search words to find exposed information. One area checked saw requests increase from a few to hundreds each day. Since ServiceNow transaction logs do not keep track of the POST body, defenders can see that automated searches happened and how much data was returned, but they can’t know the exact search words the attacker used.
Some of this Salesforce activity is like past ShinyHunters attacks, but Reco says there is no proof linking the current campaign to that group.
The researchers pointed out that earlier groups like ShinyHunters often used several systems and various IP addresses, while the City-Forum setup has stayed on the same IP address since March 2025.
Salesforce admins should check guest-user sharing rules, object and field permissions, file access, member visibility, and self-registration settings.
For LWR sites, Reco advises turning off the Experience Builder option that lets guest users use public APIs when it’s not needed. This will prevent access to different API endpoints used for gathering and stealing data.
ServiceNow admins need to check which search sources are available in Service Portals. They must make sure that sensitive data search sources have strong authentication and access controls.
