The City-Forum campaign represents a sustained, methodical assault on customer-facing portals rather than a vulnerability hunt. Operating from a single German IP address since March 2025, the attacker has systematically enumerated and extracted data from Salesforce Experience Cloud and ServiceNow Service Portals across telecommunications, financial services, and public-sector organisations. The attacks exploit a configuration problem endemic to portal deployments: overly permissive guest-user access that exposes sensitive records to unauthenticated visitors. On Salesforce, the attacker targets both legacy Aura framework endpoints and the newer Lightning Web Runtime (LWR) infrastructure through GraphQL queries—a technique Reco notes has not appeared in public attack tools previously. ServiceNow deployments face a different vector: the native /api/now/sp/search endpoint, which accepts anonymous requests and can leak data when search sources permit guest access. The persistence of this single infrastructure for over a year, combined with climbing attack volumes, suggests either a well-resourced threat actor or a compromised server being exploited by multiple parties.
For CX teams, the implications are direct and uncomfortable. Your Experience Cloud and Service Portal configurations are likely already under reconnaissance, if not active exploitation. The attacker's reliance on guest-user enumeration means the vulnerability sits not in Salesforce or ServiceNow's code, but in decisions your organisation made about who should access what. This raises a critical question: how many CX leaders can confidently state what data their guest users can actually reach, particularly across self-service portals and community sites built years ago? The attack pattern also exposes a blind spot in ServiceNow logging—transaction records do not capture POST body content, meaning you can detect that automated searches occurred without knowing what was searched for, leaving defenders reactive rather than investigative.
The remediation path is clear but labour-intensive. Salesforce administrators must audit guest-user sharing rules, object permissions, file access, and self-registration settings across all Experience Cloud deployments, with particular attention to disabling public API access in Experience Builder where unnecessary. ServiceNow teams need to review which search sources are exposed through Service Portals and enforce strict authentication on sensitive data sources. However, the broader lesson cuts deeper: if your portal security posture depends on remembering to restrict guest access correctly, you have already lost. The City-Forum campaign will likely persist until organisations shift from permissive-by-default configurations to explicit, auditable access controls—a transition that requires treating guest-user access as a security decision, not a convenience feature.
An ongoing data theft campaign uses custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals. [...]