One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
- ID
- 15180
- Status
- summarized
- Published
- 18 Aug 2026, 7:30 PM
- Fetched
- 18 Aug 2026, 9:42 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/one-attacker-has-scraped-both.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.5
- Created
- 18 Aug 2026, 9:43 PM
- Tags
- Audience
- developerssaas_founders
What happened
Research by agent security platform Reco identifies a single server (158.220.87.79 on a Contabo VPS in Germany) that has been scraping Salesforce Experience Cloud and ServiceNow Service Portal sites since at least March 2025, targeting telecoms, banks, enterprise software vendors, and public sector portals. The attacker uses a compiled Go program (fingerprinted via net/http default user agent) that goes beyond known Aura guest-access abuse by also hitting Salesforce's Lightning Web Runtime UI-API across versions v56.0–v66.0 and an undocumented ServiceNow endpoint POST /api/now/sp/search. One target logged over 560,000 events from the same IP.
Why it matters
If your organization runs a Salesforce Experience Cloud site or ServiceNow Service Portal with a public-facing guest user, audit that guest profile's object and field permissions now—Reco's findings show the guest identity is the common exploit vector across all techniques, and it can only be restricted, not deleted. Malaysian banks, telecoms, and government portals are in the target profile, so local teams using these platforms should verify guest access is scoped to only what the public site actually needs.
Discussion angle
How to audit and lock down Salesforce/ServiceNow guest user permissions before this scraper—or a copycat—hits your portal, and whether the UI-API and ServiceNow search endpoints are even on your team's radar as attack surfaces.