Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

City-Forum Salesforce and ServiceNow guest-user exploitation campaign

Campaign
First reported
Last updated
Happening score
H score 43
3 unique sources, 3 articles

Summary

Hide ▲

Reco says the City Forum campaign is a custom Go-based toolset running from 158.220.87.79 on a Contabo VPS and used to pull records from Salesforce and ServiceNow customer portals. The activity has been active since at least March 2025, includes Salesforce Aura traffic, Salesforce UI-API requests across v56.0 through v66.0, and a native ServiceNow Service Portal search endpoint. Reco says one target logged over 560,000 events from the same IP, and the observed targets span telecoms, banks and financial services, enterprise software vendors, and public sector portals. Reco has not attributed the activity to a named group.

Related Happenings

ShinyHunters Salesforce Experience Cloud data theft claims

Data Leak
H score40 First: 09.03.2026 19:12 Last: 09.03.2026 19:12 Sources 1

About this happening: ShinyHunters has claimed ongoing theft of data from Salesforce Experience Cloud instances, putting exposed customer records at risk across hundreds of organizations*...

Open Happening

Timeline

  1. 12.08.2026 16:00 4 articles · 13d ago

    City-Forum targets Salesforce and ServiceNow guest access

    Initial Disclosure

    Reco says City-Forum is a custom multi-platform toolset targeting unauthenticated guest user access in Salesforce Aura, Salesforce LWR, and ServiceNow. The campaign includes the first observed in-the-wild exploitation of Salesforce’s UI-API guest surface, uses a single Go binary from the same box against both platforms, and pairs Salesforce data collection with a ServiceNow Service Portal search endpoint while appearing as protocol-legitimate traffic.

    Show sources
    Open in new tab