threat-intel
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
High
Summary
A single server has been systematically scraping data from Salesforce and ServiceNow customer portals since March 2025, targeting industries including telecoms, finance, and public sector. The attacker, operating under the ‘City Forum’ campaign, utilizes a Go-based tool to exploit persistent guest user accounts and bypass security measures. Remediation involves tightening guest profile access rather than modifying the endpoints themselves.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data