Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

City-Forum Salesforce and ServiceNow guest-user exploitation campaign

Campaign
First reported
Last updated
Happening score
H score 34
1 unique sources, 1 articles

Summary

Hide ▲

The City-Forum campaign is actively targeting Salesforce and ServiceNow with a custom multi-platform toolset, enabling guest-user enumeration and content exfiltration across multiple sectors. The operation is focused on telecoms, banks and financial-services firms, enterprise-software vendors, and public-sector portals. A fixed infrastructure node has remained active since March 2025, suggesting sustained and stealthy activity.

Timeline

  1. 12.08.2026 16:00 2 articles · 3h ago

    City-Forum targets Salesforce and ServiceNow guest access

    Initial Disclosure

    Reco says City-Forum is a custom multi-platform toolset targeting unauthenticated guest user access in Salesforce Aura, Salesforce LWR, and ServiceNow. The campaign includes the first observed in-the-wild exploitation of Salesforce’s UI-API guest surface, uses a single Go binary from the same box against both platforms, and pairs Salesforce data collection with a ServiceNow Service Portal search endpoint while appearing as protocol-legitimate traffic.

    Show sources
    Open in new tab