Persistent Threat Actor Exploits Vulnerabilities in Salesforce, ServiceNow Portals

A persistent threat actor has been exploiting vulnerabilities in Salesforce and ServiceNow portals across multiple industries since March 2025, according to research by agent security platform Reco.

The attacker uses a single piece of infrastructure hosted on a commodity VPS through the German provider Contabo, with a default user agent that suggests a compiled program is being used. The campaign, dubbed City Forum, has targeted telecoms, banks and financial services firms, enterprise software vendors, and public sector portals.

The threat actor leverages the guest identity granted to unauthenticated visitors on Salesforce Experience Cloud sites and ServiceNow portals, which cannot be deleted but can be restricted. This allows them to read records that are effectively public, even if they require login to view in a browser.

Reco has provided detection steps for security teams to identify the activity, including looking for specific IP addresses, request paths, and user agents. Remediation involves tightening guest profile access rather than endpoint security, as both UI-API and ServiceNow search endpoints are working as designed.