Mystery attacker spent a year raiding Salesforce and ServiceNow portals
- ID
- 13876
- Status
- summarized
- Published
- 13 Aug 2026, 9:32 PM
- Fetched
- 13 Aug 2026, 11:37 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/cyber-crime/2026/08/13/mystery-attacker-spent-a-year-raiding-salesforce-and-servicenow-portals/5287368
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 6.5
- Created
- 13 Aug 2026, 11:39 PM
- Tags
- Audience
- developerssaas_founders
What happened
Researchers at Reco have tracked an attacker dubbed "City-Forum" spending over a year harvesting data from over-permissioned Salesforce and ServiceNow guest portals worldwide, targeting telecoms, banks, cybersecurity firms, and public sector bodies since at least March 2025. The attacker used custom tooling against Salesforce Lightning Web Runtime sites via the UI API's GraphQL layer and a little-documented ServiceNow Service Portal search endpoint, exploiting misconfigured guest permissions rather than platform vulnerabilities. The busiest target logged over 560,000 enumeration events from the attacker's IP.
Why it matters
If you ship customer or partner portals on Salesforce or ServiceNow, audit your guest user permissions and disable self-registration where possible—this campaign proves over-permissioned guest accounts are being actively and systematically raided right now. The attack vector is configuration, not a CVE, so no patch will save you; only tightening guest access and reviewing what records guests can read will.
Discussion angle
Walk through how a Salesforce LWR guest site or ServiceNow Service Portal can accidentally expose record-level data to anonymous users, and what a quick permission audit checklist looks like for teams running these portals.