A new cyber threat actor has been identified operating a large-scale, long-running campaign targeting Salesforce Experience Cloud and ServiceNow portals globally This article explores cybercrime groups shinyhunters. . Dubbed the "City-Forum Campaign," this operation has been quietly siphoning data from telecommunications providers, banks, financial services firms, enterprise software vendors, and public-sector portals since March 2025.
Unlike known cybercrime groups such as ShinyHunters, which typically abuse Salesforce's legacy Aura framework via over-permissioned guest user accounts, this threat actor has devised a more advanced approach. While the campaign continues to leverage high-volume Aura enumeration, it also targets Salesforce's newer Lightning Web Runtime (LWR) sites through UI-API data layer lacking public exploitation tooling or documented research.
Key Infrastructure Indicators: - Custom User-Agent: Every request includes the Go-http-client/1.1 user agent, indicating an automated, compiled Go application rather than a web browser. Platform / Subsystem Targeted Endpoint / Feature Mechanism & Method Defensive Challenge Salesforce Aura getConfigData / getItems Automated object enumeration High-volume guest API queries Salesforce LWR GraphQL UI-API (v56.0 – v66.0) Unauthenticated record scraping Lacks public tooling/documentation ServiceNow POST /api/now/sp/search Probing Knowledge Bases & Catalogs Returns HTTP 201 for all requests Reco researchers reveal that the campaign does not exploit zero-day platform vulnerabilities. Salesforce Environments: Review guest sharing rules, strip unnecessary object and field-level permissions, disable self-registration where unneeded, and turn off guest access to public APIs within Experience Builder.
