The City-Forum data theft campaign is actively harvesting records from misconfigured Salesforce Experience Cloud and ServiceNow customer portals, and, according to Reco, the volume is climbing. The attacks do not exploit any vulnerability in either platform. Instead, they go after data that organisations have inadvertently left open to unauthenticated guest users through overly permissive sharing rules, portal configurations, or poorly scoped object permissions.
Reco has traced the entire campaign to a single IP address: 158.220.87.79, hosted by German VPS provider Contabo. The attacker’s infrastructure has remained on that same address since at least March 2025, a period Reco describes as more than a year of continuous operation. The requests almost always carry the default Go-http-client/1.1 user agent, making the fingerprint unusually consistent across targets. That IP resolves to the domain city-forum.com, which gave the campaign its name.
Targets span a wide range of sectors: telecommunications companies, banks and financial services firms, enterprise software vendors, security and data privacy companies, and public-sector portals worldwide. Reco reports that so far it has observed only guest-user activity, though the firm notes it cannot rule out authenticated access.
How the City-Forum Data Theft Campaign Works Against Salesforce
On Salesforce, most of the observed activity targets the older Aura framework. The attacker sends requests to the /aura or /s/sfsites/aura endpoint, first invoking HostConfigController.getConfigData to enumerate objects accessible to the guest account, then using SelectableListDataProviderController.getItems to retrieve records from those objects. The busiest target Reco has observed recorded more than 560,000 events from the attacker’s IP address, with nearly all of them tied to guest Aura enumeration.
This type of Salesforce guest-user abuse has precedent. ShinyHunters previously used a modified version of the AuraInspector tool to steal exposed records from misconfigured Experience Cloud portals, employing multiple systems and different IP addresses across those earlier campaigns. City-Forum’s infrastructure, by contrast, has stayed fixed on one address throughout.
What makes City-Forum distinct, however, is its reach into Salesforce’s newer Lightning Web Runtime (LWR) framework. Mallory reports that Reco describes this as the first in-the-wild abuse of the Salesforce UI API guest surface. On LWR sites, the attacker uses Salesforce’s UI API to pull data exposed to guest accounts via GraphQL requests sent to /webruntime/api/services/data/{version}/graphql. Reco says it has not seen any public attack tools using this technique, and existing tools including AuraInspector, S-RET, and CirrusGo do not touch the webruntime interface.
The attacker also probes Experience Cloud sites for /SiteRegister and /CommunitiesSelfReg endpoints to check whether self-registration is enabled, a configuration that could allow a guest to create an authenticated external account with broader access to records.
ServiceNow Portals Under Pressure
On the ServiceNow side, the attacker targets Service Portals through the native POST /api/now/sp/search?sysparm_cancelable=true endpoint. Reco says it had not previously seen this endpoint abused in attacks. It accepts anonymous requests and can return data when search sources are configured to permit guest access. By varying search terms, the attacker can enumerate exposed information systematically; one environment Reco investigated saw requests grow from tens to hundreds per day.
A practical headache for defenders: ServiceNow transaction logs do not record the POST body. Administrators can see that automated searches occurred and how much data was returned, but cannot determine the exact search terms the attacker used.
The connection between all the targets, across both platforms, is the same IP address and the same Go-http-client/1.1 user agent. GBHackers notes that the IP is registered to ASN 51167, the autonomous system number associated with Contabo. Reco describes these combined indicators of compromise as appearing across almost all attacks in the campaign targeting both platforms. While the Aura-based activity echoes ShinyHunters’ methods, Reco says there is no evidence tying City-Forum to that group.
Reco’s recommended mitigations are platform-specific. Salesforce administrators should review guest-user sharing rules, object and field permissions, file access, member visibility, and self-registration settings. For LWR sites specifically, Reco recommends disabling the Experience Builder option that allows guest users to access public APIs where it is not required, which would block access to the API endpoints used for enumeration. ServiceNow administrators should audit which search sources are exposed through Service Portals and ensure sensitive data sources require strict authentication. With the campaign’s IP address unchanged since at least March 2025 and request volumes rising, those configuration reviews are not optional housekeeping.
