{"id":9140,"date":"2026-08-14T13:33:12","date_gmt":"2026-08-14T13:33:12","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9140"},"modified":"2026-08-14T13:33:12","modified_gmt":"2026-08-14T13:33:12","slug":"salesforce-servicenow-data-targeted-in-city-forum-attacks","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9140","title":{"rendered":"Salesforce, ServiceNow data targeted in \u2018City-Forum\u2019 attacks"},"content":{"rendered":"<div>\n<div class=\"grid grid--cols-10@md grid--cols-8@lg article-column\">\n<div class=\"col-12 col-10@md col-6@lg col-start-3@lg\">\n<div class=\"article-column__content\">\n<div class=\"container\"><\/div>\n<p class=\"wp-block-paragraph\">Records held in <a href=\"https:\/\/www.reco.ai\/blog\/city-forum-campaign-salesforce-servicenow\" target=\"_blank\" rel=\"noopener\">Salesforce and ServiceNow systems are under attack<\/a> leaving user data exposed, according to researchers at Reco.<\/p>\n<p class=\"wp-block-paragraph\">The attack appears similar to those perpetrated by the extortion group ShinyHunters, Reco said. ShinyHunters has been particularly active this year, <a href=\"https:\/\/www.csoonline.com\/article\/4124684\/shinyhunters-ramp-up-new-vishing-campaign-with-100s-in-crosshairs.html\">attacking dating sites in January<\/a> and <a href=\"https:\/\/www.csoonline.com\/article\/4184408\/oracle-peoplesoft-zero%E2%80%91day-fuels-shinyhunters-extortion-spree.html\">Oracle in June<\/a>, and there are fears that they could have found a new target.<\/p>\n<p class=\"wp-block-paragraph\">Reco has named the latest campaign of attacks \u201cCity-Forum,\u201d after a domain name associated with the attackers\u2019 IP address. While it bears similarities to Shiny Hunters\u2019 past exploits, there are also differences. This time around the attacker penetrated the systems through the UI-API layer, an attack point that Reco had not seen used before, and had also created its own toolset to carry out the attack. It is also targeting a native ServiceNow Service Portal search endpoint that has almost no online documentation or well-known open-source tools.<\/p>\n<p class=\"wp-block-paragraph\">The threat is particularly noteworthy, Reco said, as the attackers have studied the services to map different common data-leak vectors, a sign of an advanced approach.<\/p>\n<p class=\"wp-block-paragraph\">Regardless of who the attackers were and how the attack was carried out, one thing should be clear: Organizations should be increasingly careful about who they give login credentials to.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Records held in Salesforce and ServiceNow systems are under attack leaving user data exposed, according to researchers at Reco. The attack appears similar to those perpetrated by the extortion group ShinyHunters, Reco said. ShinyHunters has been particularly active this year, attacking dating sites in January and Oracle in June, and there are fears that they [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":9141,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9140","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9140"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9140"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9140\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9141"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}