Reco has uncovered the City-Forum campaign, an ongoing data-theft operation that uses custom tools to steal records exposed to anonymous users in Salesforce Experience Cloud and ServiceNow portals. The activity is tied to the IP address 158.220.87.79 and has been linked to broad targeting of organizations worldwide, including attacks against Salesforce Aura and LWR sites as well as ServiceNow Service Portals. #CityForum #Salesforce #ServiceNow #Contabo #AuraInspector #ShinyHunters
Keypoints
- City-Forum is an active data-theft campaign tracked by Reco.
- The attacks originate from a single IP address, 158.220.87.79, hosted by Contabo.
- Victims include telecom firms, banks, software vendors, and public-sector portals worldwide.
- The attacker abuses Salesforce guest access through Aura and LWR GraphQL endpoints.
- ServiceNow Service Portals are also targeted via the anonymous search API endpoint.