Loading story…
Researchers have identified a stealthy campaign dubbed City-Forum that is harvesting data from Salesforce Experience Cloud sites and ServiceNow Service Portals by abusing overly permissive anonymous guest access rather than exploiting a platform vulnerability. The activity has reportedly been ongoing since at least March 2025 and has targeted organizations in telecommunications, banking and financial services, enterprise software, and the public sector. Investigators said the actor uses a custom multi-platform toolset, including a single Go-based binary, to enumerate Salesforce Aura, Lightning Web Runtime, and ServiceNow environments and exfiltrate information that victims had already exposed to unauthenticated users.
The campaign is notable for what researchers described as the first observed in-the-wild exploitation of Salesforce's UI-API guest surface, including GraphQL-based queries across versions v56.0 to v66.0, while ServiceNow targeting includes the undocumented /api/now/sp/search endpoint to retrieve readable knowledge base and catalog content. Activity was tied to the IP address 158.220.87.79, associated with city-forum.com, with requests reportedly using the Go-http-client/1.1 user agent from a Contabo-hosted VPS in Germany. Researchers said they found no evidence of a breach in Salesforce or ServiceNow themselves, but warned that misconfigurations such as self-registration and excessive guest permissions could allow broader access and urged defenders to audit public portals, restrict guest capabilities, and review logs for the identified indicators.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Reco compared City-Forum with a separate ShinyHunters campaign that was disclosed in March 2026. According to the researchers, that earlier activity targeted Salesforce Aura only and had no known ServiceNow targeting.
Researchers said the campaign's infrastructure, including the domain city-forum.com, had been associated with the same IP address 158.220.87.79 since March 2025. They observed the operator continuing to use that single machine over an extended period instead of rotating infrastructure.
Researchers said the City-Forum activity has been active since at least March 2025, harvesting data from exposed guest-access surfaces in Salesforce Experience Cloud and ServiceNow Service Portals. The campaign relied on permissive anonymous access rather than exploiting vulnerabilities in either platform.
Reco disclosed the City-Forum campaign as a stealthy operation using a custom multi-platform Go-based toolset to enumerate and exfiltrate data from Salesforce Aura, Salesforce LWR, and ServiceNow guest-access surfaces. The researchers described it as the first observed in-the-wild exploitation of Salesforce's UI-API guest surface and said they could not attribute the activity to a specific actor.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcedarkreading.com
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcereco.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Salesforce warned of increased threat activity targeting **publicly accessible Experience Cloud** sites where **guest user profiles** are misconfigured with overly permissive access, enabling unauthenticated users to query and exfiltrate Salesforce CRM data via the Aura framework’s exposed API endpoints (notably `/s/sfsites/aura`). Salesforce stated it has **not identified an inherent platform vulnerability**, attributing the risk to customer configuration—specifically excessive permissions granted to the Experience Cloud guest user profile. Salesforce said attackers are using a **modified version of *AuraInspector***—an open-source auditing tool released by Mandiant—to move beyond identifying exposed objects to **mass scanning and data extraction** from affected sites. Separately, **ShinyHunters** publicly claimed it is conducting ongoing data-theft activity and characterized the issue as a “new bug,” while Salesforce reiterated the activity is driven by misconfiguration and issued mitigation guidance emphasizing least privilege, auditing guest permissions, and high-impact hardening such as **disabling guest access to public APIs** and removing the **`API Enabled`** permission from the guest profile.
Jun 29, 2026
Bishop Fox disclosed widespread **public data exposure** risks in ServiceNow environments caused by misconfigured access controls and portal settings rather than a single platform zero-day. In 166 authorized assessments, the firm found that **31% of instances** exposed data to unauthenticated users, with positive findings affecting roughly three-quarters of the organizations represented in those cases. The exposures were observed on **Service Portal widgets** and the **Table REST API**, where public sessions could sometimes retrieve full backend records or at least confirm record counts without credentials. Researchers said the stock **ticket-attachments** widget was a frequent source of exposure, leaking metadata tied to internal business processes and potentially revealing sensitive operational details. To help defenders identify these weaknesses, Bishop Fox released **Snowpick**, an open-source Go-based scanner that tests public ServiceNow surfaces from an unauthenticated perspective, distinguishes full-record exposure from count-only leaks, and produces bounded evidence for remediation. The findings reinforce that organizations must validate widget behavior, table access, and ACL enforcement independently on any publicly reachable ServiceNow instance.
Jul 24, 2026
A coordinated wave of cyberattacks in 2025 targeted organizations using Salesforce’s CRM platform, resulting in significant data breaches at major companies including Google and Workday. Attackers exploited the inherent trust and connectivity of cloud-based CRM systems, focusing on social engineering rather than technical vulnerabilities. Workday confirmed that attackers accessed a database containing business contact information for up to 11,000 corporate customers and 70 million individual user records, with the breach discovered in early August 2025. Google also disclosed that its Salesforce instance used for Google Ads leads was compromised, leading to the theft of over 2.5 million customer records, including business contact details and sales notes for small and mid-sized clients. Cisco and other organizations were also listed among the victims of this campaign. The threat group responsible, identified as UNC6040 and associated with ShinyHunters, used telephone-based social engineering (vishing) to trick employees into granting access or sharing credentials. Attackers convinced targets to use a modified, unauthorized version of the Salesforce Data Loader app, which enabled them to exfiltrate sensitive data from Salesforce environments. Mandiant, working with Google, provided proactive defense recommendations, emphasizing that the attacks did not exploit Salesforce vulnerabilities but rather relied on manipulating end users. The attackers’ tactics included delayed extortion demands, sometimes occurring months after the initial compromise. The breaches highlighted the risks of interconnected cloud services and the importance of robust identity and access management. Security experts stressed the need for organizations to harden their Salesforce and other cloud assets against social engineering. The incidents underscored the growing trend of targeting SaaS platforms through human factors rather than technical flaws. Lessons from these breaches include the necessity of employee training, multi-factor authentication, and vigilant monitoring of third-party integrations. The scale and sophistication of the attacks demonstrated the evolving threat landscape for cloud-based business applications. Organizations are urged to review their incident response plans and ensure that all users are aware of the risks posed by social engineering campaigns. The breaches serve as a warning for enterprises to reassess their security posture around cloud CRM platforms and to implement layered defenses against both technical and human-centric threats.
Jun 29, 2026