A growing data-theft campaign known as “City-Forum” is extracting information from misconfigured Salesforce Experience Cloud and ServiceNow customer portals. According to security researchers at Reco, the attacker is using custom tools to harvest data that organizations have mistakenly left accessible to anonymous, unauthenticated visitors. The attacks are ongoing, and their volume continues to rise. The campaign’s technical fingerprint is unusually consistent. Reco reports that all observed attacks originate from a single IP address, 158.220.87.79, hosted by German virtual private server provider Contabo. The address has been associated with the city-forum.com domain since at least March 2025. The attacker also almost always uses the default Go-http-client/1.1 user agent when downloading data, creating a distinct signature across targeted organizations. The campaign does not exploit vulnerabilities in Salesforce or ServiceNow. Instead, it retrieves data that organizations have inadvertently exposed to unauthenticated guest users through overly permissive sharing rules, permissions or portal configurations. Both platforms use guest accounts for unauthenticated visitors, so records made accessible to those accounts can potentially be retrieved over the internet through API endpoints. Reco has so far observed only guest-user activity, although it cannot rule out authenticated-user involvement. On Salesforce, most observed activity targets sites built on the older Aura framework. The attacker sends requests to the `/aura` or `/s/sites/aura` endpoints to determine whether objects such as Accounts, Contacts and Cases are publicly accessible. Reco says the attacker first invokes `HostConfigController.getConfigData` to enumerate objects available to the guest account, then uses `SelectableListDataProviderController.getItems` to retrieve accessible records. The busiest target recorded more than 560,000 events from the attacker’s IP address, nearly all related to guest Aura enumeration. Although abuse of Aura endpoints has previously appeared in ShinyHunters data-theft campaigns, the City-Forum attacker also targets Salesforce sites built with the newer Lightning Web Runtime framework. On these sites, the attacker uses Salesforce’s UI API to retrieve data exposed to guest accounts by sending GraphQL requests to `/webruntime/api/services/data/{version}/graphql`. Reco says it has not seen any public attack tools use this technique. The attacker also probes `/SiteRegister` and `/CommunitiesSelfReg` to determine whether self-registration is enabled, which could allow a guest to create an authenticated external account with broader access. The same attacker is targeting ServiceNow Service Portals through the native `POST /api/now/sp/search?sysparm_cancelable=true` endpoint, which Reco says it had not previously seen abused in attacks. Search terms can be varied to enumerate exposed information. In one investigated environment, requests rose from tens to hundreds per day. Because ServiceNow transaction logs do not record POST bodies, defenders can see that automated searches occurred and how much data was returned, but cannot determine the exact search terms used. While some Salesforce activity resembles previous ShinyHunters attacks, Reco says there is no evidence linking the current campaign to that group. Earlier ShinyHunters campaigns typically used multiple systems and different IP addresses, whereas the City-Forum infrastructure has remained on the same IP address since March 2025. Salesforce administrators are advised to review guest-user sharing rules, object and field permissions, file access, member visibility and self-registration settings. For LWR sites, Reco recommends disabling the Experience Builder option that permits guest access to public APIs when it is not required. ServiceNow administrators should review which search sources are exposed through Service Portals and ensure that sources containing sensitive data are protected by strict authentication and access controls. Any Somali organization using Salesforce or ServiceNow can reduce this risk by restricting guest access: if records are available to an unauthenticated account through a public portal, automated tools may retrieve them without exploiting a software vulnerability.