As reported by The Hacker News, research from Reco details a year-long scraping campaign — dubbed "City Forum" — operated from a single Contabo-hosted VPS (158.220.87.79) that has been quietly exfiltrating records from Salesforce Experience Cloud sites and ServiceNow Service Portals across telecoms, financial services, software vendors, and public sector organizations.

Cloud Security Alert: The significance is that this low-effort approach has sustained access to sensitive data for over 17 months because the underlying vulnerability is architectural, not technical.

What should grab defenders' attention is not the sophistication of the actor. A compiled Go binary using a default net/http user agent is about as unsophisticated as tooling gets. The significance is that this low-effort approach has sustained access to sensitive data for over 17 months because the underlying vulnerability is architectural, not technical.

Guest Users Are the New Anonymous FTP

Both Salesforce Experience Cloud and ServiceNow Service Portal rely on a persistent, unauthenticated "guest user" identity that executes all public-facing requests. This identity cannot be deleted — only restricted. The moment an administrator exposes an object or record to the guest profile, that data is effectively public, regardless of whether the site's UI requires login to display it.

The core issue is not that attackers are clever — it's that SaaS platforms normalize broad guest access as a default, and organizations treat portal deployment as a configuration task rather than a security boundary.

This is the same class of problem that plagued on-premises SharePoint and anonymous FTP servers a decade ago, now reborn in SaaS. The ShinyHunters Salesforce activity demonstrated the same root cause on the Aura framework. The City Forum actor has simply expanded the attack surface to include Salesforce's Lightning Web Runtime UI-API (versions v56.0–v66.0) and ServiceNow's poorly documented /api/now/sp/search endpoint — neither of which have received significant public security scrutiny.

Why This Matters Beyond the Named Targets

The industries hit — telecom, banking, public sector — are exactly those running large customer self-service portals. But any organization using Salesforce Communities, Experience Cloud, or ServiceNow Customer Service Management is potentially exposed. The damage is not just data leakage: scraped customer records, case details, and internal knowledge base articles become fuel for subsequent social engineering, credential stuffing, and fraud campaigns.

The fact that one target logged over 560,000 events from a single IP also raises a detection gap question. If that volume went unnoticed, it suggests many organizations are not monitoring guest user activity at all — treating SaaS as a black box that the vendor secures by default.

Shield53 Recommendations

Shield53 Recommendations
Audit guest user permissions immediately. On Salesforce, review the Guest User profile for every Experience Cloud site and remove object-level read access that is not strictly required for public functionality. On ServiceNow, review ACLs applied to the public role on Service Portal pages and search endpoints.
Implement event monitoring. If you license Salesforce Shield or Event Monitoring, create detection rules for the Go-http-client user agent, requests to /webruntime/api/services/data, and anomalous volume from single IPs. On ServiceNow, enable and audit instance access logs for repeated calls to /api/now/sp/search.
Block or rate-limit the known infrastructure. Add 158.220.87.79 to WAF and CDN blocklists. Treat the Go default user agent as suspicious on guest-facing endpoints and apply rate limiting or CAPTCHA challenges.
Adopt a least-privilege guest model. Treat the guest user as a zero-trust identity. Default to no access, then explicitly grant only what each public page requires. Document and review guest permissions quarterly as part of SaaS posture management.
Extend SaaS security posture management (SSPM) to cover portal configurations. Native CSPM tools do not cover SaaS application-level settings. Ensure your SSPM tooling or manual reviews include Experience Cloud and Service Portal configurations, not just core CRM or ITSM settings.

The City Forum campaign is a reminder that in SaaS, the most dangerous vulnerability is often a checkbox an administrator never unchecked. Until organizations treat guest user permissions with the same rigor as IAM roles in cloud infrastructure, actors with minimal resources will continue harvesting data from the front door.