The City-Forum attacks reveal how easily a seemingly public portal can be turned into a silent data exfiltration channel. The campaign targets Salesforce Experience Cloud and ServiceNow, without exploiting any previously unknown vulnerability in the platforms themselves.
The Reco investigation, cited by BleepingComputer and SecurityWeek, describes an ongoing operation targeting telecommunications companies, banks, enterprise software providers, and public utilities. The researchers do not attribute the campaign to a specific group.
See also: ShinyHunters: Salesforce data theft via OAuth
How City-Forum attacks work
The primary access point is the Guest User, the account used for unlogged visitors. In Salesforce, attackers are looking at older Aura implementations and newer LWR sites. In ServiceNow, they are looking at public Service Portals, where search sources may return content without sufficient authentication.
According to Reco, a single Go binary communicates with Aura, LWR, and ServiceNow from the same machine. In Salesforce, requests to /aura are used to list available objects and retrieve records, while in LWR sites, data collection goes through the UI API and GraphQL. The image suggests a custom-built tool rather than simply using a ready-made scanner.
In ServiceNow, the campaign leverages the /api/now/sp/search to retrieve content from a portal’s search sources. The activity may appear perfectly legitimate at the protocol level because it uses normal service functionality. This explains why large-scale data extraction is not always easy to distinguish from normal usage.
See also: Klue: OAuth token breach exposes Salesforce data
The infrastructure and data exposed
Researchers link the City-Forum attacks to the IP 158.220.87.79 and the domain city-forum.com. The same infrastructure is reportedly still active as of March 2025, with no address change. Requests often use the default user agent Go-http-client/1.1, indicating an automated tool that does not mimic a regular browser.
The most heavily trafficked Salesforce environment recorded more than 560,000 events, mostly enumeration actions via guest access. The objects that could be exposed depend on each organization’s settings and could include accounts, contacts, cases, files, or knowledge content. There is no indication that Salesforce or ServiceNow infrastructure was compromised; the researchers report that data that was recovered was already made available to anonymous visitors.
Enabling self-registration in Salesforce increases the risk, as an anonymous visitor may attempt to create an account with more privileges. Reco has not observed the use of an authenticated user so far, but does not rule out this possibility. At the same time, the fixed address of the infrastructure is a useful indicator for checking log files.
Protection measures for administrators
City-Forum attacks make it necessary to review from the Guest User perspective. Salesforce administrators should review sharing rules, object and field permissions, file access, member visibility, and self-registration. On LWR sites, it is necessary to evaluate whether the setting that allows guest users to use public APIs is required.
In ServiceNow, auditing should cover portals that are accessible offline and the search sources that connect to them. Any source that returns articles, directories, or records without strict restriction should be logged out or require authentication. Security teams can also look for requests to /api/now/sp/search, IP 158.220.87.79 , and user agent Go-http-client/1.1.
The process should not be limited to a simple IP blocking. Administrators need to confirm what data was visible, review relevant logs, and check if the same settings appear on other portals. This way, the remediation also covers possible previous access.
Reco suggests additional checking for requests to the Salesforce endpoints /aura, /SiteRegister, /CommunitiesSelfReg , and the UI API. Disabling self-registration where it is not needed limits a potential upgrade from anonymous to authenticated access. The critical takeaway is that requiring a login by itself does not fix incorrect permissions rules.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Klue: Second hacking group stole customer data
City-Forum attacks are not based on a spectacular exploit, but on the gap between what an organization thinks it is publishing and what its APIs actually return. Securely configuring guest accounts, monitoring relevant endpoints, and regularly auditing permissions are now essential requirements for any public portal.
