Back Feeds2.Feedburner

A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months

Feeds2.Feedburner •Mirko Zorz • August 12, 2026

Most security stories start with something broken. This one starts with everything working as designed. Researchers at Reco have been tracking a campaign they call City-Forum, named after a domain registered in 2002, abandoned, and now resolving to a generic rented server from a German hosting provider. From that server, someone has been pulling records out of Salesforce and ServiceNow portals around the world. The activity has not stopped, and there is more of it … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

City-Forum Campaign Targets Salesforce and ServiceNow Data Exposures The City-Forum campaign has been actively stealing data from Salesforce and ServiceNow portals since March 2025. Researchers at Reco have identified that the threat actor utilizes custom tools to exploit overly permissive guest access configurations. The campaign has targeted various sectors, including telecommunications, financial services, and public-sector organizations globally. The attacks are ongoing, with a notable increase in activity, primarily using a specific IP address linked to a German VPS provider. The threat actor has developed unique techniques to probe both Salesforce's Lightning Web Runtime and ServiceNow's Service Portal, indicating advanced research and mapping of potential data leak paths. No vulnerabilities in the platforms are being exploited; instead, the attacks rely on misconfigurations allowing unauthorized access. The volume of attacks has surged, with one organization recording over 560,000 events from the attacker's IP. The City-Forum campaign resembles previous attacks by ShinyHunters but employs different tools and methodologies. 6 sources 71

Extracted Entities

A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (2)

MITRE ATT&CK (1)