An ongoing data theft campaign, dubbed "City-Forum" by the SaaS security firm Reco, is targeting data exposed to unauthenticated users through misconfigured Salesforce Experience Cloud and ServiceNow customer portals. The attacks, which are not exploiting vulnerabilities in either platform, have been traced to a single server and are reportedly increasing in volume.
Reco has observed the attacks originating from the IP address 158.220.87.79, hosted by the German VPS provider Contabo. This IP address has been associated with the domain city-forum.com since at least March 2025, suggesting a persistent infrastructure. The attackers consistently use the default "Go-http-client/1.1" user agent for data downloads.
The campaign targets a wide range of organizations globally, including telecommunications companies, banks, financial services firms, enterprise software vendors, security and data privacy companies, and public-sector entities. Reco emphasizes that all observed activity involves guest user accounts, though the possibility of authenticated user compromise is not ruled out.
The attacks leverage overly permissive sharing rules, permissions, or portal configurations that grant guest accounts access to data records. Both Salesforce Experience Cloud and ServiceNow utilize guest accounts for unauthenticated visitors. When these accounts are misconfigured, data can be retrieved via various API endpoints.
On Salesforce, the attackers primarily target the older Aura framework by sending requests to the `/aura` or `/s/sfsites/aura` endpoints. They first invoke `HostConfigController.getConfigData` to enumerate objects accessible to guest accounts, such as Accounts, Contacts, and Cases. Subsequently, `SelectableListDataProviderController.getItems` is used to retrieve records from these accessible objects. One heavily targeted environment recorded over 560,000 events from the attacker's IP, predominantly related to guest Aura enumeration.
While similar Salesforce guest-user abuse has been seen in past ShinyHunters campaigns, which used modified AuraInspector tools, the City-Forum attacker also targets Salesforce sites built with the newer Lightning Web Runtime (LWR) framework. For LWR sites, the attackers employ Salesforce's UI API to steal data exposed to guest accounts through GraphQL requests sent to `/webruntime/api/services/data/{version}/graphql`. Reco notes that this specific technique has not been observed in public attack tools like AuraInspector, S-RET, or CirrusGo.
The campaign also probes Salesforce Experience Cloud sites for `/SiteRegister` and `/CommunitiesSelfReg` endpoints to determine if self-registration is enabled. If active, this could allow a guest to create an authenticated external account with broader access privileges.
For ServiceNow Service Portals, the attacker targets the native `POST /api/now/sp/search?sysparm_cancelable=true` endpoint. This endpoint, used for portal search functionality, accepts anonymous requests and can return data if search sources are configured for guest access. Attackers vary search terms to enumerate exposed information, with one environment seeing search requests escalate from tens to hundreds daily. A challenge for defenders is that ServiceNow transaction logs do not record the POST body, preventing the exact search terms from being identified.
Despite similarities to previous ShinyHunters activity, Reco states there is no evidence linking the City-Forum campaign to that group. Previous campaigns typically utilized multiple systems and diverse IP addresses, whereas the City-Forum infrastructure has remained consistent on a single IP address since March 2025.
Salesforce administrators are advised to review guest-user sharing rules, object and field permissions, file access, member visibility, and self-registration settings. For LWR sites, Reco recommends disabling the Experience Builder option that allows guest users to access public APIs when it is not essential, as this blocks access to API endpoints used for data enumeration and theft. ServiceNow administrators should review search sources exposed through Service Portals and ensure sensitive data search sources enforce strict authentication and access controls.
