Someone has spent more than a year rifling through Salesforce and ServiceNow portals around the world, harvesting data that organizations accidentally left open to anyone who came looking. Researchers at Reco have named the operation "City-Forum" after a domain connected to its infrastructure. The domain has pointed to the attacker's server since March 2025, although exactly when the campaign began is unclear. Reco says the activity is continuing and increasing in volume. Reco isn't naming the targets, but said it spotted the attacker poking around portals belonging to telecoms companies, banks and other financial services firms, enterprise software vendors, cybersecurity companies, and public sector bodies. "In the last year, we've seen many threat actors that use Aura enumeration against over-permissioned Salesforce guest users. This actor is different," said Nitay Bachrach, senior security researcher at Reco. On Salesforce, the attacker targets Lightning Web Runtime (LWR) sites through the UI API's GraphQL layer, an approach Reco says it has not found documented in public research or incorporated into publicly available attack tools. Over at ServiceNow, the same operator queries a native Service Portal search endpoint that has received little public attention. The tooling also checks whether Salesforce sites permit self-registration, potentially offering a route from anonymous guest access to an authenticated external account with permission to see considerably more data. Reco said it saw these checks across most of the Salesforce targets it examined. "The threat actor created their own toolset, based on research and techniques which are not well documented online," Bachrach said. "They studied the services to map different common data leak vectors – this is an advanced actor." This isn't casual poking around either. Reco said the busiest Salesforce target logged more than 560,000 events from the attacker's IP during the campaign, almost all attempts to enumerate data available to guest users. Reco linked the Salesforce and ServiceNow activity to the same server, which targeted multiple organizations around the world. More unusually, the attacker hasn't bothered changing its infrastructure: the same IP address and domain have remained in use for at least 17 months, with related custom tooling doing the rounds across both platforms. ServiceNow told us it is "aware of a security company’s blog post claiming certain configurations are creating security risk. As noted in the security company’s post, there are no allegations of a compromise of the ServiceNow environment. Nonetheless, we take third party reports seriously and are investigating accordingly. Our priority is to protect our customers, their data, and our systems." Salesforce has not yet responded to The Register's questions. Salesforce customers have already had one very public lesson in what can happen when guest access gets too generous. In March, ShinyHunters told The Register it had stolen data from around 100 high-profile companies and nearly 400 websites after going after over-permissioned Experience Cloud guest accounts. City-Forum isn't doing quite the same thing, and Reco isn't blaming ShinyHunters. "We don't know who this is, and we're not ruling anyone in or out," Bachrach said. Reco says all the activity it observed was conducted without authentication, with the attacker collecting information that organizations had exposed through permissions, sharing rules, search sources, or other configuration choices. "If the guest can read a record, so can anyone on the internet," Bachrach warned. "That is not a platform vulnerability." Which is good news for Salesforce and ServiceNow, perhaps, but rather less comforting for anyone now wondering what their guest account has been showing the guests. ®