New “City-Forum” Hackers Attacking Salesforce and ServiceNow Instances Worldwide

HomeCyber Attack News New “City-Forum” Hackers Attacking Salesforce and ServiceNow Instances Worldwide By Kavichselvan August 12, 2026 New "City-Forum" Hackers Attacking Salesforce and ServiceNow Instances Worldwide A newly identified threat actor is running a large-scale, long-running cyber campaign targeting Salesforce Experience Cloud sites and ServiceNow Service Portals globally. Dubbed the “City-Forum Campaign” after a domain tied to the attacker’s infrastructure, the operation has been quietly siphoning data from telecommunications providers, banks, financial services firms, enterprise software vendors, and public-sector portals since at least March 2025. Unlike known cybercrime groups such as ShinyHunters, which typically abuse Salesforce’s legacy Aura framework via over-permissioned guest user accounts, this threat actor has engineered a more advanced approach. While the campaign continues to leverage high-volume Aura enumeration, it also targets Salesforce’s newer Lightning Web Runtime (LWR) sites through UI-API a data layer lacking public exploitation tooling or documented research. Simultaneously, the attackers target an undocumented native search endpoint within ServiceNow Service Portals. City-Forum Hackers Target Salesforce and ServiceNow Reco researchers note that this combination reflects a deliberate effort by a sophisticated operator who researched both cloud platforms to map out unexpected data-leak vectors. Bypassing access controls in this manner highlights similar risks associated with service portal vulnerabilities. All observed attack activity originates from a single IP address: 158.220.87[.]79, hosted on a Contabo Virtual Private Server (VPS) in Germany. Key infrastructure indicators include: Custom User-Agent: Every request carries the Go-http-client/1.1 user agent, indicating an automated, compiled Go application rather than a web browser. Persistent Domain: The IP resolves to city-forum[.]com, a domain linked to the attacker’s infrastructure since March 2025. Static Origin: The adversary has maintained this single IP address for over a year, departing from the rotating proxy networks typically used in broad scanning campaigns. As detailed in Reco’s security research, the operation has been quietly harvesting enterprise assets without relying on traditional exploit payloads. Adversaries frequently map out organizational perimeters using targeted Google dorking techniques before executing automated extraction workflows. On standard Salesforce deployments, the custom Go tool uses Aura’s getConfigData and getItems calls to enumerate and page through exposed objects such as Accounts, Contacts, and Cases. A single targeted organization logged over 560,000 enumeration events. On LWR sites, the tool queries the GraphQL-based UI-API, sweeping through API versions v56.0 through v66.0 to extract records. The framework also systematically probes for open self-registration portals, where guest accounts can gain elevated access beyond default profiles. On ServiceNow, the actor floods the undocumented POST /api/now/sp/search endpoint—the backend powering the portal’s search interface—testing which Knowledge Bases and service catalog items are readable without authentication. Because both unauthenticated and authenticated requests return an HTTP 201 Created status code, defenders cannot rely solely on HTTP response codes to detect unauthorized activity. Uncovering these hidden interfaces demonstrates why identifying internal api flaws is vital for securing cloud infrastructure. Platform / Subsystem Targeted Endpoint / Feature Mechanism & Method Defensive Challenge Salesforce Aura getConfigData / getItems Automated object and record enumeration High-volume guest API queries Salesforce LWR GraphQL UI-API (v56.0 – v66.0) Unauthenticated record scraping Lacks public tooling/documentation ServiceNow POST /api/now/sp/search Probing Knowledge Bases & Catalogs Returns HTTP 201 for all requests Reco researchers highlight that the campaign does not exploit zero-day platform vulnerabilities. Every retrieved record was accessible due to overly permissive guest user configurations. Salesforce Environments: Review guest sharing rules, strip unnecessary object and field-level permissions, disable self-registration where unneeded, and turn off guest access to public APIs within Experience Builder. ServiceNow Environments: Audit search sources attached to public portals and review Knowledge Base “Can Read” criteria to restrict permissive “Any User” grants. Threat Hunting: Query network logs for traffic from 158.220.87[.]79 or requests carrying the Go-http-client/1.1 user agent interacting with portal APIs. [Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model -> Register Now Tags cyber security cyber security news Copy URL Linkedin Twitter ReddIt Telegram Kavichselvan Kavichselvan is a Cybersecurity Enthusiast and Journalist covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world. Cyber Security Guide Top 10 Malware Threats of the Week – AsyncRAT, Remcos, and Xworm Lead the Surge Three PhaaS Kits Targeting US Organizations to Steal M65 Logins by Bypassing MFA How Top SOCs Detect and Stop AI Phishing that Beats Email Gateways  Top 10 Phishing Kits Used by Hackers to Launch Cyberattacks (July 20-26, 2026) An SOC Story of Why Fast Answers Beat Perfect Answers in Cyber Incident Response  Latest Cyber News Cyber Security News China-linked Hackers Using AI Agents to Attack Taiwan Government Websites Cyber Security News Critical Adobe ColdFusion Vulnerabilities Allow Attackers to Execute Arbitrary Code Cyber Security WhatsApp Unveils New Scam Alert Feature to Protect Users from Social Engineering Attacks Cyber Attack News Eclipse Ransomware Launches RaaS Platform Targeting Windows, Linux, and ESXi Infrastructure Cyber Security News Google Chrome 151 Patches Five High-Severity Use-After-Free Flaws in V8, Blink, and Extensions Expert Talks Expert Talks From Reactive Forensics to Predictive Defence: Strengthening Cyber Resilience in Banking  Expert Talks Beyond the Lure: What the DoNot Campaign Reveals About Modern Cyber Espionage  Expert Talks Your Incident Response Plan Has a Dependency You Never Approved Expert Talks Security in the AI Era Starts with First Principles  Cyber Security News Planning Your AI Security – How will You Manage All Your Resources?