Overview
Security researchers at Reco.ai have exposed a long-running, systematic data theft campaign — dubbed "City-Forum" — that has been silently extracting enterprise data from Salesforce Experience Cloud portals and ServiceNow Service Portals worldwide for at least 17 months, operating entirely as an anonymous guest user. No software vulnerability was exploited; the attacker relies entirely on misconfigured guest-user permissions to harvest data that organizations have inadvertently exposed to unauthenticated visitors.
The campaign has targeted banks, telecom operators, financial services firms, enterprise software vendors, security companies, and public-sector portals globally.
The Threat Actor
The campaign is named "City-Forum" after the attacker's domain, city-forum.com — a domain originally registered in 2002 and now pointing to a rented Contabo VPS server in Germany (158.220.87[.]79). All attack traffic originates from this single IP address. Reco does not attribute the campaign to a known threat group, though they note overlap with techniques previously associated with ShinyHunters in attacking Salesforce Aura endpoints.
Custom Toolset
What makes City-Forum notable is its purpose-built Go-based attack toolset — a single compiled binary that fingerprints and attacks all three platforms from the same host, masquerading as a legitimate browser via the Go-http-client/1.1 user agent.
Salesforce Aura Attacks
The attacker's Salesforce module replays the high-volume Aura framework enumeration technique — the same vector used by ShinyHunters in prior campaigns — blasting API endpoints to extract records exposed to guest users.
Salesforce LWR (First Observed)
More significant is the first-ever documented in-the-wild abuse of Salesforce's Lightning Web Runtime (LWR) UI-API. City-Forum's tooling sweeps Salesforce API versions v56.0 through v66.0 using GraphQL queries against the LWR interface, a surface with no prior publicly documented exploitation. No existing tooling existed for this vector before Reco's discovery.
ServiceNow Portal Search
Against ServiceNow targets, City-Forum floods the undocumented internal POST /api/now/sp/search endpoint — the portal's backend search handler — to enumerate all Knowledge Base articles and service catalog items accessible without authentication. Critically, one of the two default data sources for this endpoint carries no authentication check at all, making it trivially accessible.
Detection Evasion
One particularly effective evasion technique: both authenticated and unauthenticated requests to these platforms return HTTP 201 Created responses. Any detection system relying on anomalous HTTP status codes will see nothing unusual.
What Data Is Being Stolen
The campaign targets data that organizations have misconfigured as accessible to unauthenticated users, including:
- Customer records and case data exposed via Experience Cloud portals
- Internal knowledge base articles containing sensitive operational details
- Service catalog entries, employee directory fragments, and support ticket data
The risk depends entirely on each organization's guest-user sharing rule configuration — poorly secured portals may expose employee PII, financial records, internal process documentation, or regulated data.
No Patch, Only Configuration
Because no software vulnerability is being exploited, there is no vendor patch to apply. This is a configuration problem requiring organizational remediation:
For Salesforce:
- Audit all guest-user sharing rules and remove unnecessary data exposure
- Disable guest-user access to the LWR UI-API unless explicitly required
- Review Salesforce's own guidance on securing Experience Cloud guest user access
- Monitor Aura and UI-API endpoints for anomalous enumeration volumes
For ServiceNow:
- Enable authentication on all Service Portal knowledge base data sources
- Audit
sp_searchendpoint access and restrict unauthenticated data sources - Review portal configurations for inadvertent public data exposure
Timeline
- March 2025: Earliest observed City-Forum activity (17 months prior to disclosure)
- August 12, 2026: Public disclosure by Reco.ai
Indicators of Compromise
- Source IP:
158.220.87[.]79(Contabo VPS, Germany — may have rotated by time of reading) - User agent:
Go-http-client/1.1 - High-volume requests to
/auraendpoints or LWR UI-API versions v56–v66 - Bulk
POST /api/now/sp/searchrequests from unauthenticated sessions
Recommendations
Organizations running public-facing Salesforce Experience Cloud or ServiceNow portals should immediately audit their guest-user permission models. The fundamental question: what data returns when you browse your own portal without logging in? If the answer includes anything sensitive, configuration hardening is overdue.