The City Forum campaign is a good example of how serious data exposure does not always require a sophisticated zero-day or even the compromise of an authenticated user. Sometimes the attacker simply discovers that an application is willing to provide far more information to an anonymous user than anyone intended.

According to research highlighted by The Hacker News, the same attacker-controlled infrastructure has been systematically extracting information from Salesforce and ServiceNow customer portals since at least March 2025. The activity has affected organisations across sectors including telecom, banking and financial services, enterprise software, security, data privacy and the public sector.

What makes this campaign particularly concerning is its persistence and automation. Researchers traced the activity to a single server at 158.220.87.79, using the default Go net/http user agent, suggesting that the attacker developed a purpose-built tool for systematically enumerating and extracting accessible records. In one Salesforce environment alone, more than 560,000 events associated with the same source were reportedly observed.

The attacker has also gone beyond techniques commonly associated with Salesforce Experience Cloud abuse. In addition to targeting the older Aura framework, the campaign reportedly interacts with Salesforce Lightning Web Runtime through the UI API and sequentially probes multiple API versions. The same infrastructure has also targeted the ServiceNow Service Portal search API, showing that the operation is not tied to one vendor or one vulnerable endpoint.

The most important lesson is that this is fundamentally an access-control and data-exposure problem.

Both Salesforce Experience Cloud and ServiceNow portals can operate with persistent guest identities for unauthenticated visitors. If those guest identities have unnecessary permissions to objects, fields, knowledge-base content or other records, attackers may be able to retrieve that information directly through legitimate application interfaces. In other words, the API may be functioning exactly as designed while the security policy behind it is dangerously permissive.

This distinction matters. Traditional security controls are often designed to identify exploits, malware, malformed packets or known attack signatures. Here, an attacker may be making technically valid HTTPS requests to legitimate APIs and receiving information that the application has been configured to provide. Blocking such activity therefore requires more than looking for an exploit signature.

Organisations should review anonymous and guest permissions with the same seriousness normally applied to privileged users. Public portals should expose only the minimum information required for their intended function, and permissions should be evaluated at the object, record and field level rather than assuming that a login page automatically protects the underlying data.

Monitoring is equally important. Security teams should establish baselines for how anonymous users normally interact with public portals and investigate unusual enumeration patterns, high-volume API requests, sequential API probing, abnormal search activity and repeated attempts to access large numbers of records. The Hacker News report notes that Salesforce administrators can examine AuraRequest and Sites events, while ServiceNow administrators can review transaction logs for suspicious requests to the Service Portal search endpoint.

There is also a broader architectural lesson here. Modern enterprise applications expose enormous amounts of functionality through APIs, SaaS platforms and web services. Security can no longer be based only on whether an application is "inside" or "outside" the network. It has to understand who is requesting the data, what information that identity should be permitted to access, how much data is being requested and whether the behaviour makes sense in context.

The City Forum campaign demonstrates how attackers increasingly look for these gaps between application functionality and security policy. There may be no obvious intrusion, no malware installation and no dramatic exploit chain. The attacker can simply keep asking legitimate applications for information until somebody notices that the applications have been answering questions they should never have answered.

For organisations operating public-facing SaaS portals, the assumption should therefore be simple: if an anonymous account can access data through an API, an attacker will eventually discover it. Least privilege, continuous permission reviews, API visibility, behavioural monitoring and strong controls around public-facing identities are becoming essential parts of data security, not optional application-hardening exercises.

A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a

Source: One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025 via The Hacker News — published 18 Aug 2026.