THE City‑Forum campaign has been siphoning data from Salesforce and ServiceNow guest portals since March 2025, hitting organisations in finance, telecommunications and the public sector. Researchers first flagged the activity in mid‑2026 after noticing a steady stream of unusual API calls originating from a single IP address. Dark Reading reported that the intrusion relies on overly permissive guest accounts rather than any known software flaw.
The attackers built a custom toolset that targets the UI‑API guest surface in Salesforce’s Lightning Web Runtime, allowing unauthenticated guest users to query objects they should not see. By exploiting misconfigured permission sets on guest profiles, the toolkit can extract records ranging from customer contracts to internal tickets without triggering standard alerts. The toolkit employs encrypted channels and mimics the user‑agent strings of legitimate integrations, allowing it to blend with normal SaaS traffic.
No CVE identifiers have been assigned to the behaviour because it stems from configuration issues rather than a code vulnerability.
Reco analysts noted that the campaign displays a level of research uncommon in financially motivated intrusions, with the threat actor spending weeks mapping data models and identifying weakly guarded fields before launching the exfiltration phase. In some cases the actors spent upwards of six weeks mapping relationships between objects before attempting any data transfer.
The stealthy approach uses low‑volume queries that blend with legitimate traffic, making detection by traditional signature‑based tools difficult. The operation has been linked to telecoms and banks, but the precise motive remains under investigation.
Activity has been observed continuously from the initial compromise in March 2025 through to late August 2026, with the same IP address appearing in logs across multiple victims. Although no threat actor group has been publicly attributed, the campaign’s novel use of guest APIs marks it as a departure from reliance on public exploit frameworks. The address has been traced to a hosting provider that offers bulletproof services, though the true location remains obscured. The findings were detailed in a blog post by Reco, which highlighted the importance of reviewing guest‑access configurations. Reco researchers warned that similar techniques could be adapted to other SaaS platforms that expose guest interfaces.
Defenders should begin by auditing every guest user role in Salesforce and ServiceNow, removing any object‑level read permissions that are not strictly required for the intended public flow. Disabling self‑registration features prevents attackers from upgrading a guest account to a privileged one, a step emphasized in the SecurityWeek coverage. SecurityWeek noted that monitoring API logs for anomalous query patterns, such as repeated reads of high‑value fields from a single source, can reveal the low‑and‑slow exfiltration used in this campaign. Where guest accounts cannot be disabled, enforcing multi‑factor authentication on any privilege‑escalation attempt adds a critical barrier.
Organisations are also advised to enforce the principle of least privilege on all integrated apps, apply network segmentation to isolate SaaS traffic from internal networks, and implement behavioural analytics that flag deviations from normal query volumes. Although no software flaw is involved, keeping both platforms on the latest release ensures that any future security controls are active and that known misconfiguration guides are applied. Regular review of guest session lifetimes and timely revocation of dormant accounts further reduces the attack surface.