ServiceNow customer portals are being targeted by an ongoing data theft campaign through custom tools using new techniques, security experts warn.
SaaS security firm Reco has dubbed the campaign ‘City-Forum’, tracing it to a single server which has been targeting several organizations across the world – including telecommunications companies, financial services firms, enterprise software vendors, public-sector portals, banks, and security and data privacy organizations.
City-Forum Hacking Campaign Explained
Reco says that a single server is pulling records out of ServiceNow Service Portals – along with Salesforce Experience Cloud sites – from infrastructure that has been standing since March 2025.
This threat actor is different from those who have been using tactics like Aura enumeration against “over-permissioned” Salesforce guest users, like ShinyHunters.
It appears to be a new method. The campaign is remarkable because the threat actor appears to have created their own toolset based on techniques which are not well documented online.
“They studied the services to map different common data leak vectors – this is an advanced actor,” Reco warns.
The attacker hammers a native ServiceNow Service Portal search endpoint which has “almost no online documentation or well-known open source tools”, according to Reco. Except for Aura, they also reach Salesforce Lightning Web Runtime (LWR) sites through the UI-API.
Everything traces to a single IP, 158.220.87.79, which is on a VPS from German hosting provider Contabo, carrying the default Go net/http user agent on essentially every request. This suggests a compiled dedicated tool, rather than a browser.
The same fingerprint evident in ServiceNow environments appears in Salesforce too, across several organizations worldwide, Reco warns, adding: “It is still running, and the volume is climbing. So far, we have only seen guest user activities – never an authenticated user, but we cannot rule it out.”
The campaign was named ‘City-Forum’ because the same IP resolves to a domain of that name. This matters because passive DNS – a security system which logs historical Domain Name System query and response data over time – records it pointing at this IP since March 2025, meaning this infrastructure has been standing for more than a year.
It is not fully understood when the scanning started, but the attacker has held this infrastructure since that date, at the latest.
“ServiceNow is aware of a security company’s blog post claiming that improperly configured Service Portals can create unintended security risk. We can confirm there is no compromise of the ServiceNow environment. We proactively work with customers to support the ongoing security of their environments to best suit their unique business needs, and encourage customers to reach out to ServiceNow support if they have questions regarding specific configurations.”
– ServiceNow Spokesperson
How to Find Indicators of Compromise in ServiceNow
The IP address 158.220.87.79 and subdomains currently resolving to it, which can include the phrase ‘city-forum’, are indicators of compromise.
Request activity will land in the transaction log, syslog_transaction. Type syslog_transaction.LIST into the filter navigator (or browse to https://<instance>.service-now.com/syslog_transaction_list.do).
Open up the condition builder and add two filters which isolate the activity:
- IP Address is 158.220.87.79. This is the operator’s source
- URL starts with /api/now/sp/search – the search endpoint.
If you want to narrow the search to the threat actor hitting the endpoint, combine the two with AND. To see both populations side-by-side, including everything from that IP and everyone hitting sp/search, combine them with OR. Hit Run, and the rows that come back will be revelatory.
Final Thoughts
It’s not yet known who is behind this, and no one is being ruled “in or out” by Reco. The campaign is reminiscent of the ShinyHunters Experience Cloud campaign, but differs in some important ways – using custom tools instead of modified versions of existing ones.
A new style of attack doesn’t rule out ShinyHunters, but one new pattern is that the same IP has been carrying the same domain since March 2025, and is still scanning today, with no rotation. In any case, this exposure was down to a guest identity which was granted more than necessary.