Reported by 3 outlets
Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.39 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
update from securityweek.com
Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset
securityweek.com · 62d ago · August 12th, 2026
-
update from bleepingcomputer.com
"City-Forum" data-theft attacks target Salesforce, ServiceNow portals
bleepingcomputer.com · 62d ago · August 12th, 2026
An ongoing data theft campaign uses custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals. The data-theft campaign, dubbed City-Forum by SaaS security firm Reco, has been traced to a single server that has targeted multiple organizations worldwide. These organizations include telecommunications companies, banks and financial services firms, enterprise software vendors, security and data privacy companies, and public-sector portals. Reco says the attacks are ongoing, with activity continuing to increase. The City-Forum data theft attacks Reco says all of the attacks originate from the IP address 158.220.87.79 , hosted by German VPS provider Contabo, and almost always use the default Go-http-client/1.1 user agent when downloading data. This IP address is associated with the city-forum.com domain, which has resolved to the server since at least March 2025, indicating that the infrastructure has remained in place for more than a year. The researchers say these combined IOCs have been seen across almost all attacks targeting Salesforce and ServiceNow environments in this campaign. "The same fingerprint appears against both Salesforce and ServiceNow, across multiple organizations worldwide. It is still running, and the volume is climbing," explains Reco . "So far, we have only seen guest user activities - never an authenticated user, but we cannot rule it out." These attacks are not exploiting a vul
-
update from gbhackers.com
City-Forum Hackers Target Salesforce and ServiceNow Instances Worldwide for Data Theft
gbhackers.com · 61d ago · August 13th, 2026
A sophisticated threat campaign, referred to as “City-Forum,” is targeting publicly accessible Salesforce Experience Cloud sites and ServiceNow Service Portals, aiming to enumerate and extract data exposed to anonymous users. Security firm Reco, which identified this activity, notes that the operator is using a custom multi-platform toolset instead of relying solely on widely available offensive […] The post City-Forum Hackers Target Salesforce and ServiceNow Instances Worldwide for Data Theft appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .