Stealthy ‘City-Forum' Attacks Target Salesforce and ServiceNow With Custom Toolset (3 minute read)

2026-08-14

Reco tracked City-Forum using one Go binary against Salesforce Aura, Salesforce LWR, and ServiceNow. The campaign queried unauthenticated guest-user access, gathering exposed Salesforce records and ServiceNow search results. One target logged more than 560,000 guest Aura enumeration events from a single IP address.