An unknown threat actor has been using a custom toolset to probe Salesforce and ServiceNow instances with overly permissive guest access and steal data for more than a year.
The targets have spanned multiple sectors, including telecommunications, financial services, enterprise software, security and data-privacy companies, and public-sector portals worldwide. Researchers at AI cybersecurity firm Reco, who are tracking the campaign, have dubbed it "City-Forum" after the domain name linked to the attacker’s IP address, and it's been active since at least March 2025.
A Notably Different Data Theft Approach
What makes the campaign notable, according to Reco, is the extent to which the threat actor appears to have researched the two platforms and then built their own tools to identify data that organizations may have inadvertently left accessible to guest users.
For example, on newer Salesforce sites that use the company's Lightning Web Runtime (LWR) instead of the older Aura framework, the attacker appears to have figured out how to interact directly with the runtime's underlying data-access layer and retrieve records from exposed, guest-accessible surfaces.