Story thread · 2 reports / 2 sources
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
thehackernews.com · 2h
How the coverage leans
Across 2 sources · syndicated copies counted once
A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a
First report: Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day — helpnetsecurity.com, 2d
The conversation · 0
Sign in to join the conversation.
No comments yet — start the thread.