Introduction to City-Forum Attacks
Researchers at Reco are tracking a complex and innovative campaign targeting both Salesforce and ServiceNow via a custom-made, multi-platform toolset. The primary targets include telecoms, banks, financial-services firms, enterprise-software vendors, and public-sector portals.
City-Forum Campaign Details
The campaign, named 'City-Forum', is directed at both Salesforce Aura and the newer LWR implementations. Notably, it is the first observed in-the-wild exploitation of Salesforce's UI-API guest surface. The attacks on Aura are integrated with the LWR attacks in a single toolset, indicating a high degree of customization and sophistication.
According to the researchers, the primary access key for both platforms is the Guest User. Every Salesforce Experience Cloud has its own Guest User, which can be accessed through an unauthenticated request. Similarly, ServiceNow has a similar setup. The researchers emphasize that these guest users cannot be deleted, and requiring login does not remove them, leaving the profile, permissions, sharing rules, and any code running in its context still accessible.
Comparison with Other Attacks
To understand the degree of innovation in the City-Forum campaign, it is useful to compare it with other attacks targeting Aura, such as the ShinyHunters' Salesforce Aura Campaign disclosed in March 2026. Unlike ShinyHunters, which targeted just Aura in Salesforce using a modified version of the existing AuraInspector, City-Forum uses a new custom multi-platform toolset and also targets LWR in Salesforce and ServiceNow.
Reco notes that it does not rule out the possibility that ShinyHunters might also be behind City-Forum, stating, "We don't know who this is, and we're not ruling anyone in or out."
Campaign Characteristics and Targets
The City-Forum campaign uses a single machine, with the same IP address (158.220.87.79) carrying the same domain since March 2025, and it is still scanning today. This IP resolves to city-forum.com. The use of a single machine reduces the attacker's footprint to anomaly detection systems, making it harder to detect if stealthy but easier to block if known.
The campaign targets unauthenticated guest user access in both Salesforce and ServiceNow. However, if self-registration is enabled in Salesforce, conversion to an authenticated user could be possible, although there is no similar mechanism for ServiceNow. Being an authenticated guest user is not necessary but could provide access to more sensitive data, especially since many organizations misconfigure guest permissions.
Data Exfiltration and Stealth
Aura gives up the majority of the Salesforce data collected and exfiltrated, with the busiest target logging over 560,000 events across the campaign window, essentially all of it guest Aura enumeration. Data is also pulled from the Salesforce LWR sites using GraphQL. The ServiceNow attack targets the effectively undocumented search endpoint to detect substantial content.
The exfiltration is not noisy, being high volume but protocol-legitimate, which makes detection difficult. This stealthy approach confirms the intent behind using a single constant destination address. As with the ShinyHunters attack, there is no suggestion of a breach of the Salesforce or ServiceNow platforms, with every byte the attacker retrieved being something a site owner had exposed to anonymous users.
Conclusion and Recommendations
Being targeted by City-Forum is not a noisy, easy-to-see attack, but most things can be found if you know where to look. The Reco research blog includes detailed IOCs and remediation instructions. At the very least, as soon as possible, ensure that self-registration is not enabled to hinder any attempt for an unauthenticated guest to upgrade to an authenticated guest.
Source: SecurityWeek