A data-theft campaign called City-Forum is targeting organizations worldwide via misconfigured Salesforce Experience Cloud and ServiceNow customer portals, according to security firm Reco.
The ongoing campaign uses a single server hosted by German VPS provider Contabo. The server is linked to the city-forum[.]com domain, which has pointed to the same infrastructure since at least March 2025.
The attacks don’t involve exploitation of any Salesforce or ServiceNow vulnerability—the threat actors are simply using organizations’ data accidentally made available to anonymous guest users through weak permissions, sharing rules, or portal settings.
On Salesforce Experience Cloud sites, the campaign targets both older Aura-based sites and newer Lightning Web Runtime (LWR) sites. Against Aura sites, attackers send requests to endpoints such as /aura and /s/sfsites/aura to identify publicly accessible objects. One targeted environment recorded more than 560,000 events from the attacker's IP address, with most linked to guest-user Aura enumeration.
The attackers also target LWR sites through Salesforce's GraphQL API at /webruntime/api/services/data/{version}/graphql. ServiceNow portals are targeted through the anonymous POST /api/now/sp/search?sysparm_cancelable=true endpoint. Attackers can use different search terms to discover information from search sources that allow guest access. In one environment, automated requests increased from dozens to hundreds per day.
Reco says there is no evidence that City-Forum is operated by ShinyHunters, although some of the Salesforce techniques resemble earlier ShinyHunters campaigns.
Organizations are recommended to review guest-user permissions, sharing rules, object and field access, file visibility, and self-registration settings in Salesforce. LWR administrators are advised to disable guest access to public APIs when it is not required. ServiceNow administrators should review portal search sources and ensure sensitive information requires authentication and appropriate access controls.