A sophisticated data theft campaign has been targeting organizations worldwide, exploiting a common vulnerability in Salesforce Experience Cloud and ServiceNow customer portals. Dubbed “City-Forum” by SaaS security firm Reco, these attacks have been ongoing for over a year, with activity increasing steadily. The attackers are not exploiting vulnerabilities in the platforms themselves but rather stealing data that organizations have inadvertently exposed to unauthenticated guest users.
At its core, this campaign is about identifying and exploiting poorly configured sharing rules, permissions, or portal configurations that allow anyone on the Internet to access sensitive information without authentication. Both Salesforce Experience Cloud and ServiceNow use guest accounts to manage unauthenticated visitors, but when these accounts are given too much power, it becomes a security nightmare.
Reco’s researchers have identified a single server at IP address 158.220.87.79, hosted by German VPS provider Contabo, as the origin of all City-Forum attacks. This server has been in operation since at least March 2025, and its associated domain, city-forum.com, has remained online throughout this period. The researchers note that almost all attacks targeting Salesforce and ServiceNow environments in this campaign share a unique combination of indicators, including the use of default Go-http-client/1.1 user agent when downloading data.
The attackers are not using any known vulnerabilities but instead leveraging the exposure of sensitive information through poorly configured portals. On Salesforce, most observed activity targets the older Aura framework, where attackers send requests to the /aura or /s/sfsites/aura endpoint to determine which objects, such as Accounts, Contacts, and Cases, are publicly accessible. The attacker then uses HostConfigController.getConfigData to enumerate objects available to the guest account and SelectableListDataProviderController.getItems to retrieve records from accessible objects.
This type of Salesforce guest-user abuse is not new and has previously been seen in ShinyHunters data theft campaigns. However, City-Forum attackers are targeting both older Aura framework sites and newer Lightning Web Runtime (LWR) sites using different techniques. On LWR sites, the attacker uses Salesforce’s UI API to steal data exposed to guest accounts through GraphQL requests sent to /webruntime/api/services/data/{version}/graphql.
The good news is that this campaign can be mitigated with proper configuration and management of customer portals. Organizations should review their sharing rules and permissions settings to ensure they are not inadvertently exposing sensitive information to unauthenticated users. It’s also essential to regularly monitor portal activity for suspicious behavior, such as automated searches or excessive data requests.
In conclusion, the City-Forum campaign serves as a reminder that even with robust security measures in place, human error can still be a significant vulnerability. Organizations should take proactive steps to secure their customer portals and regularly review their configurations to prevent similar attacks from occurring in the future. By doing so, they can protect sensitive information and maintain the trust of their customers.
Source: Bleeping Computer — 2026-08-12