--- title: Long-running Data Theft Campaign Targets Salesforce,... description: A long-running data theft campaign dubbed "City-Forum" has been targeting Salesforce and ServiceNow instances with overly permissive guest access since at... canonical: https://daily.dev/posts/long-running-data-theft-campaign-targets-salesforce-servicenow-lxkgz2mvo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Long-running Data Theft Campaign Targets Salesforce, ServiceNow | daily.dev og:description: A long-running data theft campaign dubbed "City-Forum" has been targeting Salesforce and ServiceNow instances with overly permissive guest access since at... og:url: https://daily.dev/posts/long-running-data-theft-campaign-targets-salesforce-servicenow-lxkgz2mvo og:image: https://api.daily.dev/og/posts/lxkgz2MVO.png og:image:alt: Long-running Data Theft Campaign Targets Salesforce, ServiceNow og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Long-running Data Theft Campaign Targets Salesforce, ServiceNow **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary A long-running data theft campaign dubbed "City-Forum" has been targeting Salesforce and ServiceNow instances with overly permissive guest access since at least March 2025. Researchers at Reco found the threat actor built custom tooling to exploit less-documented interfaces, including Salesforce's Lightning Web Runtime data-access layer and an obscure ServiceNow Service Portal search endpoint. Victims span telecom, financial services, enterprise software, security firms, and public-sector organizations across North America, Europe, and Asia. Attackers could access account data, contact info, leads, content documents, and knowledge base articles. Reco published indicators of compromise and mitigation guidance, including auditing guest-user sharing rules and disabling unnecessary guest permissions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the City-Forum campaign targeting Salesforce and ServiceNow? City-Forum is a data theft campaign, tracked by security firm Reco, that has exploited overly permissive guest access on Salesforce and ServiceNow instances since at least March 2025. The attacker built custom tools to reach less-documented interfaces, including Salesforce's Lightning Web Runtime data-access layer and an obscure ServiceNow Service Portal search endpoint, stealing account data, contact info, and knowledge base content across telecom, financial, and public-sector organizations worldwide. _Security teams auditing SaaS guest-access risk can follow ongoing threat research like this on daily.dev._ ### How can I protect Salesforce guest user access from data leaks? Review guest-user sharing rules and remove access to records anonymous users don't need, disable unnecessary permissions on guest profiles, and turn off self-registration and guest file access where unneeded. Reco, the firm tracking the City-Forum campaign, recommends these steps plus auditing every Salesforce site and reviewing Event Monitoring logs for known indicators of compromise, since misconfigurations rather than defaults enabled the attacks. _Teams hardening Salesforce configurations can track emerging guest-access threats on daily.dev._ ### How does the City-Forum campaign differ from the ShinyHunters Salesforce attacks? City-Forum uses a custom toolset distinct from what ShinyHunters used against Salesforce environments, according to Reco researcher Nitay Bachrach. While ShinyHunters relied on more publicly known techniques, City-Forum's operators researched and built their own tools to interact with less-documented interfaces like Salesforce's LWR data-access layer and a ServiceNow search endpoint lacking public documentation, marking it as a more advanced actor. _Following how distinct threat actors target the same SaaS platforms helps teams stay ahead on daily.dev._ ## Similar posts on daily.dev - [ServiceNow discloses security incident exposing customer data](https://daily.dev/posts/servicenow-discloses-security-incident-exposing-customer-data-uu7it8cfu) · BleepingComputer · 2 upvotes · 0 comments - [ServiceNow tells customers a bug left some of their data exposed to the internet](https://daily.dev/posts/servicenow-tells-customers-a-bug-left-some-of-their-data-exposed-to-the-internet-2sypghmj4) · TechCrunch · 0 upvotes · 0 comments - [PeopleSoft 0-day affecting hundreds of organizations steals gigabytes of data](https://daily.dev/posts/peoplesoft-0-day-affecting-hundreds-of-organizations-steals-gigabytes-of-data-rbusirs36) · Ars Technica · 0 upvotes · 0 comments - [Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing](https://daily.dev/posts/salesforce-agentforce-vulns-allowed-0-click-crm-data-theft-anonymous-phishing-lnxc3zf0p) · The Register · 1 upvotes · 0 comments --- Tags: [#data-breach](https://daily.dev/tags/data-breach), [#salesforce](https://daily.dev/tags/salesforce) [View this post on daily.dev](https://daily.dev/posts/long-running-data-theft-campaign-targets-salesforce-servicenow-lxkgz2mvo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Long-running Data Theft Campaign Targets Salesforce, ServiceNow","url":"https://daily.dev/posts/long-running-data-theft-campaign-targets-salesforce-servicenow-lxkgz2mvo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/long-running-data-theft-campaign-targets-salesforce-servicenow-lxkgz2mvo"},"datePublished":"2026-08-12T21:30:35.702Z","dateModified":"2026-08-14T13:53:55.206Z","description":"A long-running data theft campaign dubbed \"City-Forum\" has been targeting Salesforce and ServiceNow instances with overly permissive guest access since at...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5071048b4b26e1f08396af60c377466a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5071048b4b26e1f08396af60c377466a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/long-running-data-theft-campaign-targets-salesforce-servicenow-lxkgz2mvo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"data-breach,salesforce","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Long-running Data Theft Campaign Targets Salesforce, ServiceNow"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/long-running-data-theft-campaign-targets-salesforce-servicenow-lxkgz2mvo#faq","mainEntity":[{"@type":"Question","name":"What is the City-Forum campaign targeting Salesforce and ServiceNow?","acceptedAnswer":{"@type":"Answer","text":"City-Forum is a data theft campaign, tracked by security firm Reco, that has exploited overly permissive guest access on Salesforce and ServiceNow instances since at least March 2025. The attacker built custom tools to reach less-documented interfaces, including Salesforce's Lightning Web Runtime data-access layer and an obscure ServiceNow Service Portal search endpoint, stealing account data, contact info, and knowledge base content across telecom, financial, and public-sector organizations worldwide. Security teams auditing SaaS guest-access risk can follow ongoing threat research like this on daily.dev."}},{"@type":"Question","name":"How can I protect Salesforce guest user access from data leaks?","acceptedAnswer":{"@type":"Answer","text":"Review guest-user sharing rules and remove access to records anonymous users don't need, disable unnecessary permissions on guest profiles, and turn off self-registration and guest file access where unneeded. Reco, the firm tracking the City-Forum campaign, recommends these steps plus auditing every Salesforce site and reviewing Event Monitoring logs for known indicators of compromise, since misconfigurations rather than defaults enabled the attacks. Teams hardening Salesforce configurations can track emerging guest-access threats on daily.dev."}},{"@type":"Question","name":"How does the City-Forum campaign differ from the ShinyHunters Salesforce attacks?","acceptedAnswer":{"@type":"Answer","text":"City-Forum uses a custom toolset distinct from what ShinyHunters used against Salesforce environments, according to Reco researcher Nitay Bachrach. While ShinyHunters relied on more publicly known techniques, City-Forum's operators researched and built their own tools to interact with less-documented interfaces like Salesforce's LWR data-access layer and a ServiceNow search endpoint lacking public documentation, marking it as a more advanced actor. Following how distinct threat actors target the same SaaS platforms helps teams stay ahead on daily.dev."}}]} ```