A long-running automated attack campaign is systematically stealing data from organizations that use Salesforce Experience Cloud and ServiceNow Service Portal — not by exploiting a software vulnerability, but by abusing guest account access that those organizations have misconfigured to expose more data than intended. Researchers at SaaS security firm Reco, who named the campaign “City-Forum” after a domain tied to the attacker’s server, say all observed attacks originate from a single IP address (158.220.87.79, hosted by German VPS provider Contabo) that has been running since at least March 2025. The campaign has targeted telecommunications companies, banks and financial services firms, enterprise software vendors, security companies, and public-sector portals. The volume of attack traffic is increasing.
The attacks work because both Salesforce and ServiceNow use guest accounts to handle unauthenticated visitors — and when administrators configure overly permissive sharing rules or permissions, that guest access can expose real customer data to anyone on the internet. On Salesforce’s Aura framework, the attacker sends API requests to enumerate which objects are visible to the guest account and then harvests records from those objects; one targeted organization logged more than 560,000 such requests. Unusually, the attacker is also hitting Salesforce’s newer Lightning Web Runtime (LWR) sites via GraphQL — a technique that existing public attack tools don’t cover. On ServiceNow, requests are sent through the portal search endpoint, which can return data when search sources are configured for guest access. Administrators are advised to act: for Salesforce, review guest-user sharing rules, object permissions, file access, member visibility, and whether self-registration is enabled on Experience Cloud portals; for LWR sites, disable the option that grants guest users access to public APIs when not required. ServiceNow administrators should audit which search sources are exposed through Service Portals and enforce authentication on any source that returns sensitive data.
How to check if you’re affected
Affected products are Salesforce Experience Cloud portals (Aura and LWR frameworks) and ServiceNow Service Portals where guest or anonymous access is enabled. If your organization runs either platform, check whether the guest user profile has access to object records (Accounts, Contacts, Cases) or whether self-registration endpoints are active. On ServiceNow, pull transaction logs for the /api/now/sp/search endpoint and look for high-volume anonymous POST requests — a sudden spike in query counts is the clearest indicator. The attacker’s IP address 158.220.87.79 can be used to search historical logs for past activity.