An attacker is exploiting misconfigured Salesforce and ServiceNow portals on a large scale. These attacks do not exploit vulnerabilities in the platforms themselves. Instead, they target company data that is accessible due to overly permissive access rights without authentication.
Security firm Reco is tracking the campaign under the name City-Forum. Researchers have observed attacks on organizations in sectors including telecommunications, financial services, software, cybersecurity, and the public sector. According to BleepingComputer, the activities across various victims can be traced back to the same infrastructure. According to Reco, a single IP address linked to the domain city-forum.com has been in use since March 2025.
Guest accounts grant access to data
The root of the problem lies with guest accounts. Salesforce Experience Cloud and ServiceNow use these accounts to grant visitors access to certain parts of a portal without requiring a login. However, an overly permissive configuration can also make underlying business data accessible via APIs.
In one Salesforce environment, Reco recorded more than 560,000 requests originating from the attacker’s IP address. The vast majority of these were aimed at systematically identifying data accessible via the Aura framework.
In doing so, the attacker identifies which Salesforce objects are available to guest users and then retrieves records. This may include data from Accounts, Contacts, and Cases, for example. Similar techniques have been used previously by ShinyHunters. However, Reco sees no evidence that this group is behind City-Forum.
Newer Salesforce sites are also being targeted
The campaign is not limited to the older Aura framework. Sites using Salesforce Lightning Web Runtime (LWR) are also being targeted. In these cases, the attacker uses GraphQL requests via the UI API to collect data available to guest accounts. According to Reco, this approach is notable because known tools for exploring Salesforce portals do not use this LWR interface.
In addition, the attacker checks whether Experience Cloud sites allow self-registration. If so, a guest may be able to create an external account and thereby gain more access rights.
ServiceNow investigated via search function
ServiceNow Service Portals are also automatically searched using the platform’s standard search API. If organizations have made search resources available to anonymous visitors, data can be retrieved through this method.
This also poses a problem for administrators when investigating an attack. According to Reco, ServiceNow does log that search requests were executed and how much information was returned, but it does not log the search terms used. As a result, it is difficult to determine afterward exactly which data was searched for.
Reco has observed a continued increase in the number of attacks. Organizations are therefore advised to prioritize checking their configurations. Salesforce administrators should, among other things, review permissions for guest users, access to objects, fields, and files, and self-registration settings. For LWR sites, guest user access to public APIs can be disabled when unnecessary. For ServiceNow, the focus is on the search sources available through Service Portals. Sources containing sensitive information must be accessible only after authentication.