City-Forum Hacking Campaign Targets ServiceNow and Salesforce Sites

A sophisticated hacking campaign has been targeting ServiceNow customer portals and Salesforce Experience Cloud sites using custom tools, according to security experts at Reco. The campaign, dubbed 'City-Forum', has been ongoing since March 2025 and has affected several organizations across the world.

The attackers are using a unique method that involves creating their own toolset based on techniques not well-documented online. They have studied the services to map different common data leak vectors, making this an advanced actor, according to Reco.

The campaign is notable for its use of custom tools instead of modified versions of existing ones, unlike previous campaigns like ShinyHunters. The attackers are targeting guest users with more permissions than necessary, which has allowed them to access sensitive information.