Cybersecurity researchers have uncovered a sophisticated data theft campaign targeting organizations worldwide. Dubbed City-Forum by SaaS security firm Reco, the attacks exploit vulnerable configurations on Salesforce and ServiceNow portals, allowing attackers to steal sensitive information exposed to anonymous users.
The City-Forum campaign has been linked to a single server hosted in Germany by Contabo, which has remained active since at least March 2025. The researchers have identified a distinctive fingerprint associated with this infrastructure, seen across multiple organizations worldwide using both Salesforce and ServiceNow environments.
This data theft campaign is not about exploiting vulnerabilities in Salesforce or ServiceNow software, but rather about taking advantage of poorly configured sharing rules, permissions, or portal settings that allow unauthenticated guest users to access sensitive data. Both Salesforce Experience Cloud and ServiceNow offer features to manage unauthenticated visitors, but if these accounts are given excessive privileges, anyone on the Internet can potentially retrieve exposed records.
On Salesforce, the attackers primarily target the older Aura framework, sending requests to the /aura or /s/sfsites/aura endpoints to determine which objects, such as Accounts, Contacts, and Cases, are publicly accessible. Once they identify these objects, they use specific API calls to retrieve the associated records. The most affected organization saw over 560,000 events from the attacker’s IP address, with nearly all of them related to guest Aura enumeration.
This type of Salesforce guest-user abuse is not new; it was previously used in ShinyHunters data theft campaigns. However, City-Forum takes this tactic a step further by targeting not only Aura but also newer Lightning Web Runtime (LWR) sites on Salesforce. On LWR sites, the attackers use GraphQL requests to steal exposed records through Salesforce’s UI API.
The same attacker is also targeting ServiceNow Service Portals through a native endpoint used for search functionality, accepting anonymous requests and potentially returning sensitive data when guest access is permitted. This attack vector has not been previously seen in campaigns of this nature.
While some of the activity on Salesforce may seem similar to previous ShinyHunters attacks, City-Forum’s use of ServiceNow’s native search endpoint marks a new level of sophistication. The attackers’ ability to vary their search terms to enumerate exposed information makes it challenging for defenders to detect and respond to these threats in real-time.
The practical takeaway from this campaign is that organizations must be vigilant about configuring sharing rules, permissions, and portal settings on their Salesforce and ServiceNow environments. Regular audits and monitoring of API activity can help identify potential data theft attempts. By staying informed and proactive, organizations can reduce the risk of falling victim to these types of attacks and protect sensitive information from unauthorized access.
Source: Bleeping Computer — 2026-08-12