Summary
- Reco says one campaign is querying Salesforce Experience Cloud and ServiceNow portals through unauthenticated guest access.
- Researchers have not identified a Salesforce or ServiceNow platform vulnerability behind the activity.
- The campaign exposes the security consequences of excessive guest permissions and public portal configuration.
A threat actor is systematically extracting information from exposed Salesforce and ServiceNow portals using legitimate guest-access mechanisms, according to new research that places customer configuration rather than a platform vulnerability at the centre of the campaign.
Reco has named the activity City-Forum after a domain linked to infrastructure used by the operator. The company says a single server has been observed pulling records from Salesforce Experience Cloud sites and ServiceNow Service Portals across organisations in several sectors.
The targets visible to the researchers include telecommunications companies, banks and other financial-services organisations, software providers, security and privacy companies, and public-sector portals. Reco has not publicly identified individual affected organisations.
The campaign is not being described as a breach of Salesforce or ServiceNow. Researchers say the operator is accessing information that organisations have made available to unauthenticated guest users through their own portal permissions and configuration.
On Salesforce, the activity spans both the older Aura framework and Lightning Web Runtime. Reco observed high-volume guest requests used to enumerate objects and retrieve records available to anonymous users, as well as probes against self-registration functions.
The actor also appears to have developed tooling for Lightning Web Runtime’s UI API, including GraphQL requests that move through successive API versions. Reco says this differs from more familiar public tooling focused on Salesforce Aura environments.
Against ServiceNow, the campaign targets the platform’s public Service Portal search functionality. Researchers observed repeated guest requests against the portal-search API at volumes inconsistent with normal human use. Whether those searches return sensitive information depends on the search sources and access controls configured behind a customer’s public portal.
The common security boundary across both platforms is the guest identity. Salesforce Experience Cloud sites and ServiceNow instances maintain guest-user contexts for unauthenticated visitors. If those identities can read a record, field, knowledge item, file, or search result, an external party may be able to retrieve it without first compromising an employee account.
That makes the campaign materially different from recent attacks built around stolen SaaS credentials or compromised integrations. There is no need to bypass multifactor authentication if the target data is already available to the unauthenticated role.
The incident therefore exposes a long-standing difficulty in cloud governance: access can be technically legitimate while still being excessive. Public portals are often designed to expose some content without authentication, and changes made over years can widen that access through sharing rules, object permissions, APIs, search sources, self-registration, or custom application logic.
The cloud provider controls the underlying service, but customers retain responsibility for much of the data-access model built on top of it. That division can be obscured when a SaaS service is treated as a single security boundary rather than a configurable application platform containing identities, permissions, APIs, and custom workflows.
Reco says the infrastructure associated with City-Forum has existed since at least March 2025, although the researchers cannot establish when scanning activity began. The operator remains unattributed, and Reco says it has observed guest-user activity rather than authenticated access, while acknowledging that it cannot exclude activity it has not seen.
The campaign is still active according to the researchers. Its significance lies less in a new software defect than in an adversary operationalising access paths that many organisations may not regard as part of their externally exposed attack surface.
