Stealthy Guest-Access Attacks Hit Salesforce, ServiceNow

The security firm Reco has tracked a stealthy campaign dubbed 'City-Forum' that targets both Salesforce and ServiceNow, using a custom-made multi-platform toolset. According to a blog report by the researchers, the campaign primarily aims at telecoms, banks, financial-services firms, enterprise-software vendors, and public-sector portals.

Innovative multi-platform toolset

The campaign is notable for its technical innovation, exploiting both Salesforce Aura and the newer Lightning Web Runtime (LWR) implementations. It marks the first observed in-the-wild exploitation of Salesforce's UI-API guest surface. Since Aura users still outnumber LWR users, the attacks on Aura are integrated with LWR attacks in a single toolset.

Researchers note that the same binary is used to attack both Salesforce and ServiceNow. "One Go binary hit Salesforce over both Aura and LWR and hit ServiceNow, from the same box," they wrote. This indicates a custom toolset rather than something off-the-shelf like AuraInspector.

Guest User as primary vector

The primary access key for both platforms is the Guest User. Every Salesforce Experience Cloud has its own Guest User that allows unauthenticated requests. ServiceNow is similar. "You cannot delete those guest users, and requiring login doesn’t remove them – the profile, its permissions, its sharing rules, and any code running in its context all still exist. If the guest can read a record, so can anyone on the internet," the researchers explained.

The campaign exploits unauthenticated guest access, though it could escalate to authenticated access if self-registration is enabled. "So far, we have only seen guest user activities – never an authenticated user, but we cannot rule it out," they added.

Comparison with ShinyHunters

Reco contrasted City-Forum with the ShinyHunters' Salesforce Aura Campaign disclosed in March 2026. ShinyHunters targeted only Aura in Salesforce and used a modified version of AuraInspector. City-Forum, however, also targets LWR and ServiceNow, using a novel endpoint. "[City-Forum] hammers a native ServiceNow Service Portal search endpoint that has almost no online documentation or well-known open source tools," the researchers noted.

"We don’t know who this is, and we’re not ruling anyone in or out."

— Reco researchers, in a blog report

Reco does not rule out ShinyHunters behind City-Forum, but the campaign's distinct toolset and scope suggest a different or evolved approach.

Single machine, steady IP

City-Forum operates from a single machine. "The same IP has carried the same domain since March 2025 and is still scanning today – at least seventeen months on one address, with no rotation at any point," the researchers said. The IP address 158.220.87.79 resolves to city-forum.com.

Reco draws no conclusions from this, but a single machine could reduce the attacker's footprint for anomaly detection systems. It may be easier to block once known, but harder to detect while stealthy.

Data exfiltration and detection

The majority of data collected comes from Aura. "The busiest target logged over 560,000 events… across the campaign window, essentially all of it guest Aura enumeration," the researchers reported. Data is also pulled from LWR sites via GraphQL.

The ServiceNow attacks target an undocumented search endpoint, using it to identify substantial content. "The Output length column is worth a glance while you’re here: rows returning noticeably more than the small empty-result baseline are searches that came back with content," they wrote.

The exfiltration is high-volume but protocol-legitimate, making detection difficult. This stealth is consistent with the use of a single constant destination address.

No platform breach

As with the ShinyHunters attack, there is no indication of a breach of Salesforce or ServiceNow platforms. "Every byte the attacker retrieved was something a site owner had exposed to anonymous users," the researchers emphasized.

The campaign relies on misconfigured guest permissions and exposed data rather than platform vulnerabilities.

Recommendations and remediation

Being targeted by City-Forum is not a noisy, easy-to-see attack. However, most things can be found if you know where to look. Reco's blog includes detailed IOCs and remediation instructions. At minimum, organizations should ensure self-registration is disabled to hinder any attempt for an unauthenticated guest to upgrade to an authenticated guest.

This campaign underscores the importance of reviewing guest user permissions and disabling self-registration where not needed. It also highlights the risk of undocumented or rarely-used endpoints, which may lack monitoring. Organizations using Salesforce or ServiceNow should audit their guest access configurations and monitor for unusual enumeration or data exfiltration patterns.