A long-running data theft campaign dubbed City-Forum is quietly siphoning records from Salesforce Experience Cloud sites and ServiceNow Service Portals by abusing unauthenticated guest access, with activity traced back to infrastructure active since March 2025 and still ongoing.[1][3][5][6]
Researchers at Reco describe a single virtual private server, hosted by German provider Contabo and fingerprinted by a distinctive Go-http-client/1.1 user agent, systematically querying guest-facing portals across multiple organizations and sectors worldwide.[3][1][5] All observed requests arrive as the platforms’ built-in guest users, allowing the actor to enumerate and extract customer and knowledge-base data from “public” portals without exploiting software bugs or using stolen credentials.[2][3][1]
The tooling targets both Salesforce Aura-based and newer LWR Experience Cloud implementations, stepping through consecutive UI-API GraphQL versions and hammering high-volume guest getItems and getConfigData calls, while also probing self-registration endpoints that could convert a guest exposure into an authenticated session on misconfigured sites.[1][3][2] On ServiceNow, the same infrastructure drives abnormal, escalating guest POST traffic to an effectively undocumented Service Portal search endpoint, enabling the actor to identify and retrieve records from portals whose search sources are configured to serve content to any user.[1][3][2]
Public reporting so far has not tied City-Forum to a named threat group, and there is no evidence the operation relies on a specific platform vulnerability with an associated CVE or vendor patch advisory; instead, researchers repeatedly stress that the attacker is exploiting overly permissive guest sharing and world-readable data rather than breaking the software.[2][3][1] Earlier this year, Salesforce separately warned customers about a data-extortion campaign abusing misconfigured guest accounts and Aura components in Experience Cloud, emphasizing that those incidents also stemmed from configuration issues rather than flaws in the core platform.[13] A distinct critical ServiceNow AI Platform issue, CVE-2026-0542, was disclosed in February 2026, but available reporting does not link City-Forum activity to that sandbox-bypass vulnerability.[11]
For defenders on Salesforce, Reco recommends immediately reviewing Event Monitoring logs for guest traffic, including AuraRequest and Sites entries with USER_TYPE = 'Guest', and flagging high volumes of getItems, getConfigData, version-sweeping calls to UI-API GraphQL endpoints, and hits on self-registration routes such as /SiteRegister and /CommunitiesSelfReg that could indicate reconnaissance or attempted escalation.[2][3] Salesforce guidance and independent research further advise tightening guest sharing rules, stripping guest object and field permissions, disabling “Access Activities” and “API Enabled” on guest users, turning off self-registration where it is not required, and disabling guest file access and member visibility, as well as disabling public API access for LWR sites that do not need it, to close off the exposed UI-API guest surface altogether.[2][3][13]
On ServiceNow, defenders are urged to mine syslog_transaction logs for guest requests to /api/now/sp/search, sorting entries by response size to surface searches that returned substantial records, and then mapping guest-facing portals to their search sources and underlying scripts.[2][3] Security teams should review knowledge-base “Can Read” user criteria for unconstrained “Any User” access, prune problematic kb_uc_can_read_mtom links rather than editing shared criteria records with broad blast radius, and re-scope portal search sources so that catalog and KB content is limited to appropriate roles, groups, or customers—or require login entirely for portals that do not need anonymous search—reducing the exposed attack surface City-Forum and similar campaigns can mine at scale.[2][3]
References
- Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset
- A stranger has been reading Salesforce and ServiceNow portals …
- An Advanced Attacker Is Targeting Salesforce and ServiceNow – Reco
- Briefs – CraftedSignal Threat Feed
- Cyber Security News
- Critical ServiceNow AI Platform Vulnerability (CVE-2026- …
- Salesforce Sounds Alarm Over Fresh Data Extortion Campaign
