Single Attacker Scrapes Salesforce and ServiceNow Portals Since 2025

Introduction

Recent findings from the agent security platform Reco have uncovered a sustained data‑extraction effort that has been quietly siphoning information from Salesforce and ServiceNow customer portals. The activity, which has persisted for more than twelve months, appears to originate from a single piece of infrastructure tied to the IP address 158.220.87.79. Reco has labeled this operation the "City Forum" campaign after a domain associated with the attacker’s server. This article expands on the disclosed details, examines how the campaign remained undetected for so long, and discusses what it means for organizations relying on cloud‑based CRM and ITSM solutions.

The Scope and Scale of the City Forum Campaign

According to Reco’s analysis, the attacker’s infrastructure has been making repeated requests against both Salesforce and ServiceNow portals, harvesting records that include customer data, service tickets, and potentially sensitive configuration details. The campaign is not limited to a single vertical; evidence shows activity across finance, healthcare, retail, and technology sectors. By leveraging legitimate‑looking API calls and mimicking normal user behavior, the attacker was able to blend in with regular traffic, making the exfiltration difficult to spot through conventional volume‑based anomaly detection.

• Targeted platforms: Salesforce CRM and ServiceNow ITSM portals.
• Duration: Ongoing since at least early 2025, exceeding 12 months.
• Geographic reach: Multiple industries and regions, indicating a broad opportunistic approach.
• Data harvested: Account records, case histories, knowledge‑base articles, and possibly integration credentials.

How the Attacker Evaded Detection for Over a Year

Several factors contributed to the longevity of the City Forum campaign. First, the attacker used a single, static IP address hosted on a reputable cloud provider, which reduced the likelihood of being flagged by IP‑reputation blacklists. Second, the request patterns resembled typical user interactions—such as querying knowledge bases or pulling ticket lists—allowing the traffic to slip past rate‑limiting rules that are often tuned for bursty, high‑frequency attacks. Third, the lack of obvious malicious payloads (e.g., no malware download or credential stuffing) meant that traditional endpoint or network‑based signatures did not trigger alerts. Finally, many organizations rely on periodic log reviews rather than real‑time behavioral analytics, giving the attacker a window to operate unnoticed.

Implications for Cloud‑Based CRM and ITSM Platforms

The City Forum case underscores a growing challenge: attackers are increasingly exploiting the trust model inherent in SaaS applications. Because Salesforce and ServiceNow expose rich APIs for legitimate integrations, malicious actors can abuse those same interfaces to exfiltrate data without deploying overtly hostile code. This blurs the line between normal admin activity and malicious reconnaissance, demanding a shift from signature‑based defenses to continuous behavior monitoring, anomaly detection based on user‑entity analytics, and strict enforcement of least‑privilege access controls. Additionally, organizations should consider implementing API gateway controls that enforce granular scopes, logging every request, and employing automated throttling for anomalous patterns.

Conclusion

The discovery of a year‑long scraping operation targeting Salesforce and ServiceNow portals serves as a stark reminder that even trusted cloud platforms can be abused when attackers blend their activity with legitimate traffic. Organizations must move beyond perimeter‑centric defenses and adopt intelligent, behavior‑based monitoring that can detect low‑and‑slow data exfiltration attempts. Grivyonx Cloud’s AI automation and cybersecurity services are designed to provide exactly that visibility, helping customers safeguard their cloud‑native applications against evolving threats without compromising operational agility.