--- title: "City-Forum" data-theft attacks target Salesforce,... description: An ongoing data-theft campaign called City-Forum, tracked by SaaS security firm Reco, abuses guest-user access on Salesforce Experience Cloud and ServiceNow... canonical: https://daily.dev/posts/city-forum-data-theft-attacks-target-salesforce-servicenow-portals-hmzyizuuf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: "City-Forum" data-theft attacks target Salesforce, ServiceNow portals | daily.dev og:description: An ongoing data-theft campaign called City-Forum, tracked by SaaS security firm Reco, abuses guest-user access on Salesforce Experience Cloud and ServiceNow... og:url: https://daily.dev/posts/city-forum-data-theft-attacks-target-salesforce-servicenow-portals-hmzyizuuf og:image: https://api.daily.dev/og/posts/hmZyIzUUF.png og:image:alt: "City-Forum" data-theft attacks target Salesforce, ServiceNow portals og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # "City-Forum" data-theft attacks target Salesforce, ServiceNow portals **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 5 min read · 0 upvotes · 0 comments ## Summary An ongoing data-theft campaign called City-Forum, tracked by SaaS security firm Reco, abuses guest-user access on Salesforce Experience Cloud and ServiceNow portals to steal exposed records. All attacks trace to a single IP (158.220.87.79) linked to the city-forum.com domain, active since March 2025. Rather than exploiting a vulnerability, attackers exploit overly permissive sharing rules and guest permissions, hitting older Salesforce Aura endpoints, newer Lightning Web Runtime GraphQL endpoints, and a previously unseen ServiceNow Service Portal search endpoint. One target logged over 560,000 attacker events. Reco recommends auditing guest-user sharing rules, disabling unnecessary public API access on LWR sites, and restricting ServiceNow search source permissions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the City-Forum data theft campaign targeting Salesforce and ServiceNow? City-Forum is an ongoing data-theft campaign, identified by SaaS security firm Reco, that abuses misconfigured guest-user permissions on Salesforce Experience Cloud and ServiceNow portals rather than exploiting any software vulnerability. All observed attacks originate from a single IP, 158.220.87.79, linked to the city-forum.com domain active since March 2025, and one targeted organization logged over 560,000 malicious events. _Security teams tracking active SaaS abuse campaigns like this follow ongoing coverage on daily.dev._ ### How does the City-Forum attacker exploit Salesforce Lightning Web Runtime (LWR) sites? The attacker sends GraphQL requests to the /webruntime/api/services/data/{version}/graphql endpoint via Salesforce's UI API to pull data exposed to guest accounts on LWR-based Experience Cloud sites. Reco notes this technique has not been seen in any public attack tools, unlike older Aura-targeting tools such as AuraInspector, S-RET, and CirrusGo. _Teams hardening Salesforce Experience Cloud configurations track emerging exploitation techniques on daily.dev._ ### How is the City-Forum campaign attacking ServiceNow portals? Attackers send anonymous requests to the native POST /api/now/sp/search?sysparm_cancelable=true endpoint used by ServiceNow's portal search, which can return data when search sources permit guest access. One monitored environment saw requests grow from tens to hundreds per day, and because ServiceNow transaction logs omit POST bodies, defenders cannot recover the exact search terms used. _ServiceNow admins auditing exposed search sources can follow developing SaaS security incidents on daily.dev._ ## Similar posts on daily.dev - [ServiceNow tells customers a bug left some of their data exposed to the internet](https://daily.dev/posts/servicenow-tells-customers-a-bug-left-some-of-their-data-exposed-to-the-internet-2sypghmj4) · TechCrunch · 0 upvotes · 0 comments - [ServiceNow discloses security incident exposing customer data](https://daily.dev/posts/servicenow-discloses-security-incident-exposing-customer-data-uu7it8cfu) · BleepingComputer · 2 upvotes · 0 comments - [Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing](https://daily.dev/posts/salesforce-agentforce-vulns-allowed-0-click-crm-data-theft-anonymous-phishing-lnxc3zf0p) · The Register · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-breach](https://daily.dev/tags/data-breach), [#salesforce](https://daily.dev/tags/salesforce) [View this post on daily.dev](https://daily.dev/posts/city-forum-data-theft-attacks-target-salesforce-servicenow-portals-hmzyizuuf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"\"City-Forum\" data-theft attacks target Salesforce, ServiceNow portals","url":"https://daily.dev/posts/city-forum-data-theft-attacks-target-salesforce-servicenow-portals-hmzyizuuf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/city-forum-data-theft-attacks-target-salesforce-servicenow-portals-hmzyizuuf"},"datePublished":"2026-08-12T23:11:15.507Z","dateModified":"2026-08-14T13:53:55.206Z","description":"An ongoing data-theft campaign called City-Forum, tracked by SaaS security firm Reco, abuses guest-user access on Salesforce Experience Cloud and ServiceNow...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b69646504833556371a32615bf7158fa?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b69646504833556371a32615bf7158fa?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/city-forum-data-theft-attacks-target-salesforce-servicenow-portals-hmzyizuuf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-breach,salesforce","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"\"City-Forum\" data-theft attacks target Salesforce, ServiceNow portals"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/city-forum-data-theft-attacks-target-salesforce-servicenow-portals-hmzyizuuf#faq","mainEntity":[{"@type":"Question","name":"What is the City-Forum data theft campaign targeting Salesforce and ServiceNow?","acceptedAnswer":{"@type":"Answer","text":"City-Forum is an ongoing data-theft campaign, identified by SaaS security firm Reco, that abuses misconfigured guest-user permissions on Salesforce Experience Cloud and ServiceNow portals rather than exploiting any software vulnerability. All observed attacks originate from a single IP, 158.220.87.79, linked to the city-forum.com domain active since March 2025, and one targeted organization logged over 560,000 malicious events. Security teams tracking active SaaS abuse campaigns like this follow ongoing coverage on daily.dev."}},{"@type":"Question","name":"How does the City-Forum attacker exploit Salesforce Lightning Web Runtime (LWR) sites?","acceptedAnswer":{"@type":"Answer","text":"The attacker sends GraphQL requests to the /webruntime/api/services/data/{version}/graphql endpoint via Salesforce's UI API to pull data exposed to guest accounts on LWR-based Experience Cloud sites. Reco notes this technique has not been seen in any public attack tools, unlike older Aura-targeting tools such as AuraInspector, S-RET, and CirrusGo. Teams hardening Salesforce Experience Cloud configurations track emerging exploitation techniques on daily.dev."}},{"@type":"Question","name":"How is the City-Forum campaign attacking ServiceNow portals?","acceptedAnswer":{"@type":"Answer","text":"Attackers send anonymous requests to the native POST /api/now/sp/search?sysparm_cancelable=true endpoint used by ServiceNow's portal search, which can return data when search sources permit guest access. One monitored environment saw requests grow from tens to hundreds per day, and because ServiceNow transaction logs omit POST bodies, defenders cannot recover the exact search terms used. ServiceNow admins auditing exposed search sources can follow developing SaaS security incidents on daily.dev."}}]} ```