City-Forum Data Theft Targets Salesforce and ServiceNow Portals

An ongoing data theft campaign dubbed City-Forum is actively targeting misconfigured customer portals hosted on Salesforce Experience Cloud and ServiceNow environments, according to BleepingComputer. Security researchers at Reco discovered that the campaign relies on custom tooling and a centralized infrastructure to harvest data exposed to unauthenticated guest users. Rather than exploiting a software vulnerability, the attackers leverage overly permissive sharing rules and misconfigurations to extract sensitive records from organizations worldwide, including telecommunications providers, financial institutions, and enterprise software vendors.

Technical Analysis of City-Forum Campaigns

The City-Forum campaign originates from a single server hosted by German VPS provider Contabo at the IP address 158.220.87.79, associated with the domain city-forum.com. This infrastructure has remained active since March 2025. Analysis of the operation indicates that requests almost exclusively use the default Go-http-client/1.1 user agent and target unauthenticated guest accounts rather than valid user credentials.

Salesforce Experience Cloud Targeting

Salesforce environments are probed via two distinct framework approaches:

• Aura Framework: Attackers send requests to /aura or /s/sfsites/aura endpoints. They invoke HostConfigController.getConfigData to enumerate accessible objects (such as Accounts, Contacts, and Cases), followed by SelectableListDataProviderController.getItems to retrieve underlying records. Busiest targets have experienced over 560,000 enumeration events from the attacker’s IP address.
• Lightning Web Runtime (LWR) Framework: On newer LWR sites, actors use Salesforce’s UI API to dispatch GraphQL requests to /webruntime/api/services/data/{version}/graphql. This technique bypasses older tools like AuraInspector, requiring defenders to monitor new API pathways.
• Self-Registration Abuse: Probing targets /SiteRegister and /CommunitiesSelfReg endpoints to determine whether self-registration is enabled, which could allow external account creation with broader privileges.

ServiceNow Service Portal Enumeration

In addition to SaaS configurations on Salesforce, the campaign targets ServiceNow Service Portals through the native POST endpoint /api/now/sp/search?sysparm_cancelable=true. This endpoint powers portal search functionality and accepts anonymous requests. Attackers vary search terms to enumerate exposed data sources. Because ServiceNow transaction logs omit the POST body, defenders can observe automated searches and data volumes returned, but cannot inspect the exact search terms used by the attacker.

Mitigations and Security Recommendations

Defenders must treat misconfigured SaaS access controls with high priority. Organizations utilizing these platforms should implement the following security measures:

• Audit Salesforce Sharing Rules: Review object and field-level permissions, file access, and member visibility for guest users across all Experience Cloud sites.
• Restrict LWR Public APIs: Disable the Experience Builder setting that permits guest users to access public APIs on LWR sites if such access is not strictly required.
• Harden ServiceNow Search Sources: Review which search sources are exposed through Service Portals and enforce strict authentication and access controls on sensitive data search sources.
• Monitor IOCs: Implement detection engineering rules to flag high-volume enumeration requests originating from the known threat infrastructure, specifically monitoring for anomalous Go-http-client user agent activity interacting with guest-facing API endpoints.

Related: Snowflake Hacker Pleads Guilty: Analyzing the UNC5537 Data Breach, Klue-Salesforce Breach Exposes Competitive Data; Threat Actors Hacked