60
30
55
57
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Reco tracks the City Forum campaign: one Contabo VPS has scraped Salesforce and ServiceNow guest portals across finance, telecom and public sector since March 2025.
Reco researchers identified infrastructure at 158.220.87.79, a Contabo VPS using Go's default net/http user agent, that has harvested records from Salesforce Experience Cloud and ServiceNow customer portals across telecom, financial services, enterprise software and public sector targets for over a year. The tool abuses over-privileged persistent guest users, enumerating Salesforce Aura sites (560,000+ events at one target), probing Lightning Web Runtime via the UI-API across API versions v56.0-v66.0, and hitting the poorly documented ServiceNow Service Portal search endpoint. No named victims or actor attribution yet, and activity is ongoing with rising volume. Defenders are advised to hunt the Go-http-client user agent and specific IP in Salesforce Event Monitoring logs and syslog_transaction on ServiceNow, then tighten guest sharing rules and Knowledge Base read criteria.
68
30
A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months
Reco tracks City-Forum, an actor abusing Salesforce and ServiceNow guest-user access from one IP for 17 months to enumerate portal data.
Reco's City-Forum investigation found one IP address, tied to a dormant 2002 domain, anonymously enumerating Salesforce Experience Cloud and ServiceNow portals across telecoms, banks, enterprise software vendors, and public sector since at least March 2025. No vulnerability was exploited and no credentials were used; the actor abused over-permissioned guest users, including a previously undocumented ServiceNow portal search endpoint, with the busiest single target logging over 560,000 events. Audit logs show what was requested but not which records or fields were returned, so defenders must replay anonymous requests to assess exposure.
62
60
60
57
30
30
30
45
60
60
30
45
30
55
55
30
55
30
30
30
55
30
30
60
55
30
ScienceLogic delivers secure AI deployment and smarter IT operations with Skylar AI 2.5
ScienceLogic shipped Skylar AI 2.5 with sovereign, on-premises, and secure-cloud deployment options and expanded AIOps integrations for regulated industries.
ScienceLogic announced Skylar AI 2.5, the intelligence layer of its AIOps platform, adding sovereign cloud, on-premises, and secure cloud deployment options for organizations with strict security, sovereignty, and compliance requirements. The release improves advisory accuracy, analytics and dashboards, AI governance controls such as agent monitoring and token-usage tracking, and integrations with Microsoft Teams and ServiceNow. It targets regulated industries adopting agentic AI, building on the company's FedRAMP Moderate authorization.
22
55
55
30
DataGrout helps enterprises control AI usage, governance and LLM costs
SelectHub launched DataGrout, an LLM cost and governance platform combining dynamic context pruning, symbolic inference and MCP gating, claiming about 60% token reduction.
SelectHub launched DataGrout, an LLM inference optimization and AI governance platform combining dynamic context pruning, a symbolic inference layer, and an MCP gateway with per-call token and cost monitoring. Early tests claim roughly 60% token reduction on data-intensive ERP and CRM integration tasks without accuracy loss. The platform connects via its Conduit SDK, MCP or JSON-RPC, offers its own MCP servers for SaaS apps such as Salesforce, SAP and ServiceNow, and supports bring-your-own-key LLM access or gateways like Amazon Bedrock and Kong.
25
60
30
55