One Attacker Has Scraped Both Salesforce and Service Now Portals Since 2025

Summary: Reco traced a campaign it calls City Forum to a single server, 158.220.87.79 on a Contabo VPS, that has pulled records from Salesforce and ServiceNow customer portals across telecoms, financial services, software vendors and public sector sites since at least March 2025. The tool uses Go's default net/http user agent, leans mostly on Salesforce's Aura framework (one target logged over 560,000 events from the IP) while also walking Lightning Web Runtime UI-API versions v56.0 through v66.0 and POSTing to ServiceNow's /api/now/sp/search endpoint.
What's compelling: Both platforms run unauthenticated visitors as a persistent guest user that cannot be deleted, only restricted - so any record that guest profile can read is effectively public regardless of a login prompt. Reco says the infrastructure is still active and volume is climbing, and it has not attributed the activity to a named group.

Read the original at The Hacker News ↗