City-Forum Campaign: Attackers Scrape Salesforce, ServiceNow via Guest Access

A single Go-based tool, running from one unremarkable German VPS since March 2025, has quietly harvested data from Salesforce Experience Cloud sites and ServiceNow Service Portals across telecom, banking, enterprise-software, and public-sector organizations worldwide without exploiting a single vulnerability. Researchers at Reco are calling it the “City-Forum Campaign,” and they say it’s still running, with volume climbing.

Every request in the campaign traces to 158.220.87.79, a Contabo-hosted server carrying the default Go-http-client/1.1 user agent, a telltale sign of a purpose-built binary rather than a browser. The IP resolves to city-forum.com, a domain registered in 2002, abandoned, then repurposed by the attacker.

Unusually, this actor hasn’t rotated infrastructure at all: the same address has run continuously for at least seventeen months, a departure from the multi-IP, rotating-range pattern typical of groups like ShinyHunters.

Attackers Scrape Salesforce

Crucially, nothing here is a software flaw. “No credentials were needed. There is no vulnerability here to patch,” as Help Net Security’s write-up of the campaign put it; the attacker simply asked public guest-facing portals for their contents, and the portals answered.

Most prior Salesforce guest-user abuse, including ShinyHunters’ known campaigns, has targeted the older Aura framework via /aura endpoints like getConfigData and getItems. City-Forum still does plenty of that; one target alone logged over 560,000 Aura enumeration events.

But it also reaches Salesforce’s newer Lightning Web Runtime (LWR) sites through the UI-API, a GraphQL data layer at /webruntime/api/services/data/{version}/graphql that no public tool or write-up has previously documented.

The tool systematically sweeps API versions v56.0 through v66.0, and separately probes /SiteRegister and /CommunitiesSelfReg to test whether guest accounts can self-promote to authenticated status.

On ServiceNow, the actor focuses on POST /api/now/sp/search?sysparm_cancelable=true, a native platform endpoint with little to no public documentation.

It returns HTTP 201 regardless of whether a request is authenticated or anonymous, and regardless of whether it finds anything, meaning defenders can’t distinguish a successful scrape from a dead end using status codes alone.

What actually gets returned depends entirely on which search sources are wired to the portal and whether Knowledge Base “Can Read” criteria are properly scoped, rather than left on the default “Any User” setting.

“City-Forum is a reminder that attackers don’t need a CVE when defenders leave the front door labeled ‘guest’ wide open the scariest campaigns in 2026 aren’t zero-days, they’re zero-effort misconfigurations weaponized at scale.”

Nitay Bachrach of Reco frames it plainly: “The core issue is that ‘what is public’ and ‘what should be public’ are two different things, and that’s exactly what the attacker exploited.” Asked about the most common failure across both platforms, he singles out one thing: guest/anonymous over-permission.

Organizations should audit Salesforce guest sharing rules and object/field permissions, disable self-registration where unnecessary, and turn off “Allow guest users to access public APIs” for LWR sites.

On ServiceNow, teams should map guest-facing portals to their attached search sources and review Knowledge Base read criteria for unconstrained “Any User” grants. Since audit logs can’t reveal exactly what was exfiltrated, Bachrach recommends organizations simulate the attacker’s requests internally to see what their own portals expose.

Site: Thecyberdef.com

Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.