One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Reco tracks the City Forum campaign: one Contabo VPS has scraped Salesforce and ServiceNow guest portals across finance, telecom and public sector since March 2025.
Reco researchers identified infrastructure at 158.220.87.79, a Contabo VPS using Go's default net/http user agent, that has harvested records from Salesforce Experience Cloud and ServiceNow customer portals across telecom, financial services, enterprise software and public sector targets for over a year. The tool abuses over-privileged persistent guest users, enumerating Salesforce Aura sites (560,000+ events at one target), probing Lightning Web Runtime via the UI-API across API versions v56.0-v66.0, and hitting the poorly documented ServiceNow Service Portal search endpoint. No named victims or actor attribution yet, and activity is ongoing with rising volume. Defenders are advised to hunt the Go-http-client user agent and specific IP in Salesforce Event Monitoring logs and syslog_transaction on ServiceNow, then tighten guest sharing rules and Knowledge Base read criteria.
- Single 158.220.87.79 Contabo VPS scraped both Salesforce and ServiceNow portals since at least March 2025
- Tool uses Go net/http user agent; one target logged over 560,000 Aura request events from the IP
- Distinctive probing of Salesforce Lightning UI-API (v56.0-v66.0) and undocumented ServiceNow /api/now/sp/search endpoint
- Root issue: persistent guest users granted more record access than publicly needed on both platforms
- Remediation centers on stripping guest profile access, disabling self-registration and auditing Knowledge Base read criteria
- Threat actors
- City Forum (unattributed)ShinyHunters
- Countries
- Germany
From the original article
3 min read at thehackernews.com
The Hacker News Aug 18, 2026 SaaS Security / Cloud Security A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.