A sophisticated data theft campaign known as 'City-Forum' is exploiting misconfigured Salesforce and ServiceNow portals to steal sensitive corporate data globally.

Key Takeaways

  • The 'City-Forum' campaign targets organizations via Salesforce Experience Cloud and ServiceNow portals.
  • The attacks exploit overly permissive 'Guest User' configurations rather than software vulnerabilities.
  • The campaign originates from a single long-standing German-hosted IP address.

A sophisticated data theft campaign, dubbed 'City-Forum' by SaaS security firm Reco, is currently targeting organizations worldwide. The campaign specifically exploits data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals. The targets span a wide range of critical sectors, including telecommunications, banking, financial services, and public-sector portals.

The Mechanics of the Attack

Crucially, these attacks are not exploiting direct vulnerabilities within the Salesforce or ServiceNow platforms themselves. Instead, they leverage misconfigurations. Many organizations mistakenly grant broad access to 'Guest Users' (unauthenticated visitors) through overly permissive sharing rules and permissions. Once these permissions are in place, attackers use various API endpoints to systematically scrape data.

Read Also:Overwatch Announces Third Collaboration with K-Pop Powerhouse Le Sserafim

Why This Matters: BozokMedia Analysis

BozokMedia analysis shows that the shift in attacker tactics is concerning. While previous campaigns like ShinyHunters used similar methods, the City-Forum attacker is utilizing more advanced techniques, such as targeting Salesforce's newer Lightning Web Runtime (LWR) framework via GraphQL requests. This indicates a higher level of technical sophistication and a broader target range than seen in previous years.

The vulnerability lies not in the code of the platform, but in the administrative oversight of access controls.

In the case of ServiceNow, attackers are abusing the native portal search functionality. By varying search terms, they can enumerate sensitive information. Because ServiceNow transaction logs often fail to record the specific POST body of these searches, defenders struggle to identify exactly what data was compromised.

Historical Context

Data theft via guest user abuse is a recurring theme in cybersecurity. The ShinyHunters group famously used modified versions of the AuraInspector tool to exploit similar misconfigurations in Experience Cloud. However, the City-Forum campaign is distinct due to its highly stable infrastructure, operating from the same IP address (158.220.87.79) since at least March 2025.

Did You Know?: In one investigated environment, the attacker's activity grew from just a few dozen requests to hundreds of automated searches per day.

Frequently Asked Questions

1. Are Salesforce and ServiceNow being hacked?
No, the software is not being 'hacked' in the traditional sense; rather, attackers are exploiting doors that administrators have left unlocked through poor configuration.

2. How can administrators prevent this?
Administrators must review guest-user sharing rules, object permissions, and disable public API access for guest users in the Experience Builder if it is not strictly necessary.