NewsPublished 12 Aug 2026

Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset

Source SecurityWeek

Description

Researchers observed the novel campaign exploiting unauthenticated guest access to quietly enumerate and exfiltrate exposed data from both platforms. The post Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset appeared first on SecurityWeek .

Impact

The campaign enables attackers to quietly enumerate and exfiltrate data that is publicly exposed to unauthenticated guest users on Salesforce and ServiceNow platforms. This can lead to significant data leakage from targeted organizations, including telecoms, financial services, enterprise software vendors, and public sector portals. Although no platform breaches or authenticated user exploits have been observed, the exposure of sensitive data due to misconfigured guest user permissions poses a serious confidentiality risk. The stealthy nature and high-volume but protocol-legitimate exfiltration make detection challenging.

Defensive guidance

Organizations should immediately verify and restrict guest user permissions on Salesforce and ServiceNow platforms to ensure no sensitive data is exposed to unauthenticated users. Disable self-registration features in Salesforce Experience Cloud to prevent guest users from upgrading to authenticated users, which could increase data exposure. Review and tighten sharing rules, profiles, and code running in the context of guest users. Monitor for unusual enumeration activity and consider blocking known malicious IP addresses associated with the campaign. Follow vendor advisories and security best practices for these platforms to reduce exposure.

References

securityweek.com/stealthy-city-forum-attacks-target-salesforce-and-servicenow-with-custom-toolset/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 Aug 2026, 13:11 UTC

References

Community reviews