City-Forum Hackers Exploit Salesforce and ServiceNow for Data Theft

A sophisticated threat campaign known as 'City-Forum' has been targeting publicly accessible Salesforce Experience Cloud sites and ServiceNow Service Portals worldwide, aiming to enumerate and extract data exposed to anonymous users.

The security firm Reco identified this activity and notes that the operator is using a custom multi-platform toolset instead of relying solely on widely available offensive tools.

The campaign combines well-known Salesforce Aura enumeration techniques with lesser-known methods against Salesforce Lightning Web Runtime (LWR) sites and the search infrastructure of ServiceNow portals.